A Chinese-speaking cybercriminal broke into the websites of more than 100 companies, including Deere, SharkNinja and Cummins, by handing nearly all the work to autonomous AI agents running on an open-source platform called Cairn. According to a report from Norwegian security firm NorForge, described by Reuters on October 19, 2026, the agents tried to breach more than 1,200 sites. The whole campaign cost about $5,000 in tokens, the units AI providers bill for, or roughly $50 per successful break-in.
- According to a NorForge report described by Reuters on October 19, 2026, a Chinese-speaking hacker used autonomous AI agents on the open-source Cairn platform to breach more than 100 companies, including Deere, SharkNinja and Cummins, out of more than 1,200 attempted sites.
- The campaign, which began on September 25, 2026, cost about $5,000 in tokens, or roughly $50 per successful break-in, and the hacker's instructions to the agents fit in fewer than 100 Chinese characters.
- NorForge researcher Snorre Fagerland was able to watch the operation live because the hacker left his Cairn control panel open to the internet, and NorForge has found about two dozen Cairn instances used for criminal activity since about October 2.
Snorre Fagerland, principal threat researcher at NorForge, watched the operation live. He did not defeat the hacker’s defenses. The hacker left the control panel for his own agents open to the internet.
Keep exploring artificial intelligence
Read the latest news and practical guides on AIPORT.
The hacker typed fewer than 100 characters of instructions; the agents did the rest
The operator did not write exploits, hunt for vulnerabilities or spend hours over scan results. According to the NorForge report, his instructions to the agents fit in fewer than 100 Chinese characters and described only his preferred methods of breaking in. The agents handled everything else.
The campaign began on September 25, 2026, and targeted online stores in the US, Canada, Australia and Japan. By the end of last week the agents had made more than 1,200 intrusion attempts. A successful break-in typically took them about 23 hours of trial and error.
Fagerland, who has worked in cybersecurity for nearly 30 years, told Reuters that some of the techniques impressed him. In one case the agents found no flaw in a large company’s main application. Instead of giving up, they searched public registries, found related infrastructure and located an administrative panel exposed to the internet. In that panel they spotted a subtle data-handling bug, and after many hours reported that they had forced the server to execute their own commands.
“It’s not straightforward to come up with solutions like that. It’s not script kiddie stuff,” Fagerland told Reuters.
By Fagerland’s estimate, the campaign used a mix of Chinese DeepSeek models and Anthropic’s Claude Code. Accounts of the NorForge report say worker-process names in the panel suggested a Claude Code setup running a DeepSeek model, but NorForge has not confirmed the full model configuration.
Tell our editorial team about your project. Include a short description, the relevant links and your contact information.
An open control panel let a researcher watch the attacks live
Fagerland found the campaign while scanning the internet for unsecured instances of Cairn, an open-source platform in which multiple cooperating AI agents solve complex tasks. Cairn was not built as a hacking tool. It does give agents access to a system shell, a browser and files, which makes it a convenient engine for automated intrusions.
Since about October 2, NorForge has found about two dozen Cairn instances used for criminal activity. Their operators left control panels unprotected, so the researcher could follow in real time which tasks they assigned and what the agents reported back.
The Chinese-speaking hacker was the most prolific operator observed, but not the only one. Among the others:
- one operator stole a large set of payment card data,
- another tried to have agents rob a cryptocurrency exchange,
- accounts of the NorForge report indicate that some assignments were so non-technical they amounted to short commands to get credit cards or get crypto.
The NorForge report does not name the victims. Reuters identified them on its own by analyzing the hacker’s activity logged in Cairn. The agency could not determine to what extent the intrusions led to data theft.
Deere said it took remedial action and has “no indication that sensitive information was accessed.” SharkNinja said the attack hit a separate product-support page and that the threat was contained. Cummins said it is investigating reports of a potential cyberattack on a site run by a third-party vendor. Two smaller companies also confirmed a breach. The remaining victims on the list did not respond to Reuters’ questions.
Cairn’s creator says the platform was not built for hacking
Cairn’s creator, who goes online by the handle le1xia0, acknowledged receiving Reuters’ questions but did not answer them. In a post on X, he wrote that Cairn is an innovative multi-agent architecture that was not designed for hacking attacks.
“If it is used to carry out harmful hacking attacks, that is not my intention,” he wrote.
In a separate post he added that misuse is a human decision, not a feature of the engine. NorForge said it is working to shut down the malicious instances it found and to notify victims.
Analysis
The most worrying number in this report is not “more than 100 companies.” It is “$50 per break-in.” A year ago, this level of attack automation was attributed to state-backed groups. Now it takes a credit card, a GitHub repository and a few dozen characters of instructions.
The story also carries a bitter irony. No defensive system caught this hacker. His own sloppiness did: he left the Cairn panel open to the world. Had he protected it with a password, nobody would know. I can’t say how many operators are running right now without making that mistake, and neither can Fagerland or anyone else.
Second, this is another case in which both Chinese models and Anthropic products show up in the same toolchain. Western providers can block accounts and improve safeguards, but they don’t control open models, and attackers are clearly learning to combine the two. A better filter in a single model will not be the whole answer.
Gambit and Bitsight data point to a wider shift: 600,000 stolen cards and a 67% rise in forum chatter
The NorForge report is not an isolated signal. Fagerland began looking for Cairn instances after Israeli firm Gambit Security described a campaign in September run with three open-source agents: Strix, Cairn and Hermes.
According to Gambit’s report of September 22, 2026, that campaign, also run by a Chinese-speaking operator, breached at least 27 companies and stole more than 600,000 unexpired payment card records from two of them. Eyal Sela, Gambit’s director of threat intelligence, said a completed scan of one target cost an average of $25.46, and the whole operation since July cost between $12,000 and $18,000. Gambit tied specific tools to specific models: Cairn ran on DeepSeek V4.1 Flash, and Hermes, which coordinated the whole operation, ran on Claude Opus 4.6.
Back in August, Gambit reported that Russian-speaking extortionists had used the Cursor tool to break into seven organizations.
Bitsight, which analyzes cybercrime forums, said last week that in a sample of thousands of posts from 16 underground communities, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67% between February and August 2026. Bitsight also spotted an offering called MONST3R-AI, advertised as an autonomous penetration-testing platform that runs on stolen OpenAI, Anthropic or Google API keys, which shifts the compute bill onto the key’s victimized owner.
Fagerland said he had assumed that hacking agents would need at least minimal human supervision. He now believes the technology has moved past that stage.
“The development in this field is astounding,” he said.
Attackers pick targets by weakness, not by country
Agents do not choose victims by country. They choose them by whether they can find a poorly secured administrative panel or a vulnerable version of a store platform. A Magento store with an unpatched plugin is as good a target for such an agent as any other.
The takeaway for store owners and administrators is plain: an attacker no longer needs a team or a budget, so the number of attempts will grow. At $50 per successful break-in, it pays to attack everything connected to the internet.
Sources and methodology
- Reuters, October 19, 2026: exclusive report describing the NorForge findings.
- Gambit Security report, September 22, 2026, via BleepingComputer.
- The Next Web: coverage of the NorForge report.
Quotes from Snorre Fagerland, NorForge’s principal threat researcher, and from Cairn’s creator were verified against the original English-language source material.
Analysis and editorial responsibility: Piotr Wolniewicz, Editor-in-Chief, AIPORT. Original Polish reporting: Marcin GrzeΕkowiak (aiport.pl).
This article was originally published in Polish on aiport.pl on October 20, 2026. https://aiport.pl/co-nowego-w-ai/jeden-haker-5-tys-dolarow-w-tokenach-i-ponad-100-wlaman-raport-norforge-pokazuje-jak-agenci-ai-na-platformie-cairn-atakuja-firmy/
