🔍 Read the full analysis: AI Agents And The Changing Cost Of Targeting Company Websites on ThorstenMeyerAI.com
TL;DR
Reuters, drawing on the attackers’ exposed Cairn control panels, reported that an operator used AI agents to probe more than 1,200 online shops from late September to mid-October and break into websites linked to more than 100 companies. NorForge estimated the campaign’s AI costs at about $5,000, but said that figure carries considerable uncertainty; the amount of data accessed or taken has not been established.
An unidentified Chinese-speaking operator used software agents coordinated through the open-source platform Cairn to probe more than 1,200 online shops from September 25 to mid-October, Reuters reported, citing the operator’s exposed activity records. Reuters identified websites of more than 100 companies as compromised, including those associated with Deere, SharkNinja and Cummins; the extent of any data access or theft is not known.
The reporting is based in part on internet-exposed Cairn control panels that security researcher Snorre Fagerland of NorForge found and monitored. NorForge said it identified more than 20 panels it linked to likely malicious activity, with new panels appearing over time. Its report, published October 19, grouped the activity into three clusters. Reuters separately reviewed Cairn activity and contacted companies it identified as potential victims.
NorForge’s largest cluster, named AIA0001, recorded more than 1,100 attack projects across 14 panels, according to the firm. Its records show agents sharing findings and proposed next steps as they worked toward assigned goals. NorForge measured successful projects at a little under 23 hours from start to goal on average; one ran for more than five days. These figures describe the activity in the records reviewed, not a verified measure of every intrusion.
NorForge estimated the campaign’s AI expenses at roughly $5,000 overall, or about $50 per successful hack, while warning that the estimate carried “considerable” uncertainty. Reuters reported that Deere said it took “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said a standalone product-support site was affected and the threat was contained. Cummins told Reuters it was investigating “a potential cyber-attack on a website operated by one of our third-party vendors.”
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Lower Costs, Wider Exposure
The reported campaign matters because it suggests a single operator can delegate repeated reconnaissance and intrusion attempts across many sites rather than work through each target manually. The activity does not establish that AI agents can independently breach any company, or that every targeted site was compromised. It does show how automated persistence and scale can increase the number of websites defenders may need to inspect.
NorForge’s cost estimate points to a possible reduction in the expense of running prolonged automated activity, but it is not an audited accounting and should not be treated as a standard cost per breach. For companies, the reported targets also highlight the exposure of support pages and third-party vendor websites, which may be less closely monitored than core systems. The reporting does not establish that those sites were uniformly less secure or that attackers reached companies’ internal networks.
Automated activity can also burden security teams with more alerts and reports to review. That is a practical implication, not a quantified impact in the available reporting. The case also raises questions about how defenders distinguish legitimate automated agents from malicious ones and how open-source tools are monitored without assuming that their general-purpose software is inherently harmful.
Popular right now
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
Dyson Cyclone V10 Origin Cordless Vacuum
KitchenAid Classic Series 4.5-Quart Tilt-Head Stand Mixer, Onyx Black
As an affiliate, we earn on qualifying purchases.
How Cairn Entered the Reporting
The investigation developed from separate reporting on agent-based cyber activity. In September, security firm Gambit Security described another campaign and said it had found three AI harnesses—software that lets AI models perform tasks—including Cairn. Gambit reported at least 27 companies compromised in that separate campaign and said at least 600,000 card records were taken from two companies. Those figures concern Gambit’s case, not the later campaign reported by Reuters and NorForge.
Fagerland then searched for exposed web dashboards associated with Cairn, according to NorForge. The firm said most panels required authorization, but some did not. The largest cluster in its October report recorded tasks written in Chinese. NorForge interpreted the apparent goal as gaining persistent access to e-commerce or payment infrastructure for possible later monetization; that is the firm’s assessment, not a confirmed account of what the operator ultimately did.
Cairn itself is described by NorForge as a general-purpose, state-based problem-solving engine. Its author, who uses the name le1xia0, told Reuters that Cairn “was not designed for hacking attacks” and that harmful use was not the author’s intention. The platform’s presence in the reports does not by itself show that its developer participated in, knew about or approved of the activity.
„“a little under 23 hours”“
— NorForge report
Data Access Still Unverified
Reuters said it could not establish how much data, if any, was taken. Deere reported no indication that sensitive information had been accessed, but that statement does not resolve what may have happened at other companies or websites. SharkNinja said the threat was contained, while Cummins described its case as a potential attack under investigation.
The operator’s identity has not been established in the source reporting; the description “Chinese-speaking” does not identify a person or prove nationality. Reuters found that more than 100 company websites had been broken into based on the attacker’s records, but the report does not provide a complete public victim list or independently detail the outcome at every site. NorForge’s cost estimate is explicitly uncertain, and the records do not establish whether all apparent projects achieved their intended outcomes.
Investigations and Cleanup Continue
The immediate next steps are for affected companies and their vendors to complete investigations, contain access and determine whether systems or information were exposed. Cummins said it was investigating; the available reporting does not give a timetable for its findings. Further disclosures from companies or security researchers may clarify the number of affected sites and the consequences of the intrusions.
Security teams will also be watching for additional exposed Cairn panels and related agent-driven activity. NorForge reported that new panels appeared during its monitoring, but the published material does not establish whether the same operator remains active. Any broader conclusions about the frequency, cost or effectiveness of AI-assisted intrusions will depend on more cases with independently verified outcomes.
Key Questions
What did the AI agents do?
According to Reuters and NorForge, agents coordinated through Cairn probed online shops and worked through assigned tasks. Reuters reported that the activity targeted more than 1,200 sites and that websites linked to more than 100 companies were breached.
Who operated the campaign?
The operator has not been identified. NorForge described the activity as Chinese-language, and the source reporting characterizes the operator as Chinese-speaking; it does not establish the person’s identity or nationality.
Was customer or company data stolen?
The amount of data accessed or taken in this campaign is unknown. Reuters could not establish how much data, if any, was taken. Deere said it had no indication sensitive information was accessed; that does not answer what happened at every reported victim.
How much did the campaign cost?
NorForge estimated roughly $5,000 in AI costs for the campaign, or about $50 per successful hack, and described the estimate as carrying considerable uncertainty. It is an estimate for this reported activity, not a verified or generally applicable cost.
Does this mean Cairn was built for cyberattacks?
No. NorForge described Cairn as a general-purpose problem-solving engine. Its author told Reuters the platform was not designed for hacking attacks and said harmful use was not the author’s intention. The reporting concerns how an operator used the software.
Source: ThorstenMeyerAI.com
