Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

Cairn AI agents used to breach more than 100 company sites

5 sources · 5 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Chinese-speaking operator used exposed Cairn agents against more than 100 company websites; named firms report limited or unconfirmed impact.

Researcher Snorre Fagerland of NorForge, cited by Reuters, found about two dozen exposed copies of the open-source Cairn agent platform used against company websites. The largest Chinese-language cluster, AIA0001, tried more than 1,200 sites after September 25, mostly stores in the United States, Canada, Australia and Japan, with more than 1,100 projects across 14 dashboards. NorForge estimates about a 10% success rate and roughly $5,000 in tokens. Reuters names John Deere, SharkNinja and Cummins; Deere reported no sensitive-data access, SharkNinja said a support site was contained, and Cummins is investigating a possible vendor-site attack. Data theft is unconfirmed; NorForge verified one webshell and is seeking takedowns.

Key facts
  • AIA0001 used 14 dashboards and more than 1,100 projects.
  • Estimated token spend was about $5,000, or $50 per success.
  • Successful projects averaged just under 23 hours.
  • TruffleHog verified 11% of hundreds of exposed panel secrets.
  • SecurityWeek describes two smaller clusters besides AIA0001.
  • The most active attacker set tactics in under 100 Chinese characters.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 25, 2026Agents began trying more than 1,200 sites after this date. · Cyber Security News
  2. Oct 19, 2026Reuters names Deere, SharkNinja and Cummins among victims. · The Verge
  3. Oct 20, 2026NorForge details AIA0001 cost, scale and success rate. · Cyber Security News

What each outlet adds

beyond the shared facts
  • The VergeCompany statements and Norforge takedown work.
  • Cyber Security NewsSeptember 25 start, $5,000 cost and 1,200 attempts.
  • GBHackersWorker identifier hinted at Claude Code with DeepSeek.
  • SecurityWeekTwo further clusters, including card and crypto theft.
  • The Hacker NewsNames Fagerland and one confirmed live webshell.
Vendors
Microsoft
Products
CairnPlaywrightZend Frameworkmemcached
Threat actors
AIA0001
Victims
DeereSharkNinjaCumminsJohn Deere
Organizations
NorForgeNorforge
Countries
United StatesJapanAustraliaChinaCanada
AI models
DeepSeek

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Verge · AIFirst report

    Hacker used Cairn AI agents to break into more than 100 sites

    Reuters names John Deere, SharkNinja and Cummins; Deere says no sensitive information was accessed.

  2. · 5d ago Cyber Security News

    AI agents tied to breaches of more than 100 company websites

    NorForge estimates about $5,000 in tokens for a campaign that tried more than 1,200 sites, mostly online stores.

  3. · 5d ago GBHackers

    AI-agent campaign breached websites at more than 100 companies

    NorForge tracked campaign AIA0001 across 14 dashboards; Deere, SharkNinja and Cummins were named.

  4. · 5d ago SecurityWeek

    Attackers used open-source Cairn against over 100 organizations

    Norforge found three exposed-panel clusters; Reuters names John Deere and SharkNinja, and about 10% of attempts succeeded.

  5. · 5d ago The Hacker News

    Autonomous AI agents used to breach more than 1,200 websites

    NorForge says exposed Cairn panels tied a Chinese-language cluster to web shells at named firms, with data theft unconfirmed.