One Hacker, an Army of AI Agents and 100+ Breached Websites: What the Cairn Campaign Reveals

For years, security experts warned that artificial intelligence would one day let a single attacker do the work of an entire hacking team. A report published on Monday, 19 October 2026, suggests that day has arrived. According to the Norwegian AI security firm NorForge and an exclusive report by Reuters, one hacker used a swarm of autonomous AI agents to break into more than 100 company websites, including sites linked to Deere, SharkNinja and Cummins, at an estimated cost of around $50 per successful hack.

What happened

The campaign began on 25 September 2026. The attacker, described by researchers as Chinese-speaking but not named or located, used Cairn, an open-source multi-agent AI platform that describes itself as a "general-purpose problem-solving engine".

Cairn works by handing a goal to a team of AI agents. Each agent works step by step and posts its findings to a shared board that the others can read, while a human operator can add hints. According to Reuters, the hacker's instructions were fewer than 100 Chinese characters long. They told the agents to find a way to run code on each target website and plant an "uploader" web shell, a hidden tool that would give the attacker lasting access, probably to online shops and their payment systems. After that, the agents worked largely on their own.

NorForge's principal threat researcher, Snorre Fagerland, found the operation around 2 October after spotting exposed Cairn control panels using internet-scanning tools. Those panels revealed the attacks in progress.

The numbers

Fagerland stressed that the cost figures are rough estimates with considerable uncertainty. NorForge's report puts the cost at about $5 per task when failed attempts are included.

Who was hit

Most targets were online shops. Three well-known companies responded to Reuters:

• Deere said it had taken steps to fix the problem and saw no sign that sensitive information had been accessed.
• SharkNinja said the attack affected a standalone product-support site and had been contained.
• Cummins said it was investigating a possible attack on a website run by one of its third-party vendors.

Reuters said it could not establish how much data, if any, was stolen.

Not one hacker, but several groups

NorForge judged more than 20 exposed Cairn panels to be likely malicious and grouped them into three clusters. The largest, Chinese-language cluster ran more than 1,100 attack projects across 14 panels. A separate English-language cluster of 10 panels appeared to target credit card and cryptocurrency data. A third, single panel was rated low-confidence. Across the clusters, roughly one attack in ten succeeded.

The exposed panels also held hundreds of passwords and API keys. When researchers checked them with a scanning tool, about 11% were still valid, a reminder that attackers can be careless too.

Which AI was doing the hacking?

Every task ran on a worker labelled with the names of a coding-agent tool and DeepSeek's low-cost V4.1 Flash model. NorForge interprets this as an AI coding agent running on DeepSeek's model, but that is the researchers' reading of a label, not a confirmed fact, and the companies involved had not commented in the reports we reviewed.

One example from the report shows how persistent the agents were. Unable to find a flaw in a large company's public app, they turned to a linked control panel and, after hours of trial and error, got its server to run their commands.

Why this matters

Fagerland told Reuters this was "not script kiddie stuff", and said he had expected hacking agents to still need human supervision. The campaign shows three uncomfortable shifts:

• Scale: one person could attack more than a thousand sites in parallel.
• Cost: a successful break-in may cost less than a restaurant meal in AI fees.
• Skill: the agents handled the technical work that once required experienced penetration testers.

It is not the first warning. In September, Gambit Security reported finding Cairn on an attacker's server and said AI agents had helped steal at least 600,000 credit card records from 25 companies. Taiwan's government has also said AI agents helped hackers break into its systems this year.

Cairn's author, who posts online as "le1xia0", said the platform is a general multi-agent system that was not designed for hacking or meant to be used for harm. Researchers also found that some legitimate security-testing firms had left client work exposed on Cairn panels.

What businesses should do now

• Patch quickly. AI agents grind through known weaknesses tirelessly, so unpatched plugins and admin panels are prime targets.
• Hide admin panels. Put control panels behind a VPN or IP allow-list rather than on the open internet.
• Watch for web shells. File-integrity monitoring can flag new or changed files on web servers.
• Check third parties. Two of the named incidents involved support or vendor sites rather than the main website.
• Rotate exposed keys. Store API keys in a secrets manager, not in code or open dashboards.

For a related look at how a cyberattack can disrupt ordinary business, see our story on France's supermarket fridge hack.

What happens next

NorForge says it is working with Reuters to warn victims and is asking hosting companies to take the exposed panels offline. Key questions remain open: what data was taken, whether the planted web shells have all been removed, and how AI providers will respond to their models being used this way.

Sources

• Reuters – How one hacker used AI agents and a few thousand dollars to break into scores of sites (19 Oct 2026)
• The Next Web – AI agents broke into 100+ sites for one hacker at $50 each, researcher says
• Slashdot (summarising The Verge) – A Hacker Broke Into John Deere, SharkNinja With an Army of AI Agents
• AI Weekly – Hacker’s AI agents breached 100+ sites at $50 each, NorForge says