A single human operator reportedly compromised more than 100 corporate websites across four countries using an open-source AI agent framework, according to cybersecurity firm NorForge. The incident illustrates how automated cyberattacks can now be scaled without a larger team, by delegating repetitive intrusion work to AI agents instead.
How the Attack Worked
With fewer than 100 Chinese characters supplied as instructions, the AI agents reportedly handled the rest.
Cairn, an open-source multi-agent framework, sits at the center of this campaign. It lets an operator define an objective while AI agents autonomously work through intermediate tasks. According to NorForge, agents probed targets, adapted their approach, executed commands, and continued working across sessions with limited human intervention. Successful intrusions took roughly 23 hours on average, across a campaign that reportedly targeted more than 1,200 websites in total.
John Deere, SharkNinja, and Cummins Among the Named Victims
Reuters identified the affected companies by reviewing activity associated with the attacker’s exposed Cairn infrastructure.
John Deere said it took remediation measures and had “no indication that sensitive information was accessed,” according to Reuters. SharkNinja said the incident affected a standalone product-support website and that the threat had been contained. Cummins said it was investigating a potential cyberattack involving a website operated by a third-party vendor.
No confirmed sensitive data theft from any of the three companies has been established in the available reporting. Unauthorized access to a website is not the same as confirmed exfiltration of customer or operational records.
Why This Escalation Matters
Unlike earlier script-based tools, these agents planned, iterated, and persisted across extended sessions rather than executing a single fixed sequence.
Conventional automation can branch and retry, but it generally follows defined logic. What NorForge observed went further: agents functioning closer to a tireless junior analyst than a simple scanner, revising their approach over hours without direct human input. That distinction matters for defenders, because behavioral detection is harder to apply when an agent dynamically plans and revises its intrusion attempts rather than repeating a known pattern.
The attacker’s own infrastructure introduced an unexpected complication. NorForge found more than 20 publicly exposed Cairn control interfaces it considered likely malicious, reachable from the open internet. That exposure allowed researchers to observe the operation and reconstruct parts of the campaign, according to reporting by Reuters and The Verge.
Cairn’s Creator Says the Tool Wasn’t Built for This
The platform’s intended purpose and its potential for abuse are not mutually exclusive problems.
Cairn’s creator, who uses the handle @le1xia0, said in a post, as reported by The Next Web, that the platform was never designed as a hacking tool and that harmful use reflects decisions made by users rather than the engine’s intent. That position is reasonable, and it does not resolve the underlying tension: general-purpose agent frameworks lower the barrier to both legitimate experimentation and offensive operations.
If your organization runs public-facing websites or relies on third-party vendors, the practical implication is worth taking seriously. AI orchestration infrastructure now belongs in the same category as production servers and authentication systems. Security analysts recommend network isolation, access controls, action logging, and human approval before agents can reach external systems. Leaving a control dashboard exposed to the public internet, as this campaign demonstrated, creates serious visibility risks for anyone who discovers it.
