AI Agents on Cairn Breach More Than 100 Company Websites in One Operator’s Campaign

An operator who writes in Chinese used autonomous AI agents to breach more than 100 company websites in a campaign that began on 25 September 2026. Security researcher Snorre Fagerland of NorForge published findings on 19 October 2026, and Reuters identified several of the affected companies. According to Reuters, by late last week the agents had tried more than 1,200 sites.

The agents ran on Cairn, an AI agent platform. NorForge found the operator’s control panels by scanning the internet for exposed Cairn installations, which allowed the attacks to be observed as they unfolded. As of 19 October 2026, Reuters could not establish how much data, if any, was taken.

How the Campaign Ran and How Companies Responded

Many projects gave the agents goals rather than step-by-step instructions. The goals included unauthenticated remote code execution, shell or admin access, database access and uploading a web shell, according to NorForge. Successful intrusions took just under 23 hours on average. Targets were mainly e-commerce, payment and pharmaceutical sites, with the largest cluster mostly aimed at the United States, Japan and Australia, and Canada also among the targeted countries.

Reporting links the activity to DeepSeek and Claude Code, but the link is not settled. NorForge says one worker name may mean Claude Code running a DeepSeek model, and that a second cluster appears to use the Pi coding agent. The Next Web reports that all tasks ran on the first worker. Deere said it took remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and that the threat was contained. Cummins said it was looking into a possible attack on a website run by one of its vendors. Reuters identified all three companies through its own review of the operator’s activity. Cairn’s author said the platform was not designed for hacking and that harmful use was not the author’s intention.

Cost Estimates Differ
NorForge’s report puts the average at about $5 per task, including failed attempts, while Fagerland’s estimate is about $50 per successful intrusion.

Why Low Per-Target Costs Matter

Fagerland estimated total AI token spending at about $5,000, or roughly $50 per successful intrusion, as reported by The Next Web and The Cryptonomist. NorForge’s own report gives a different measure: an average of about $5 per task, including failed attempts, with some long-running projects possibly above $100. NorForge describes its cost figures as uncertain and calls an average success rate of about 10% a reasonable assumption.

A low cost per attempt lets one operator work through many sites. The campaign reached more than 100 breached sites across more than 1,200 attempts.

The exposed panels also held hundreds of secrets, about 11% of which were verified as valid, according to NorForge. The report warns that legitimate red-team engagements were exposed too, which put client data at risk.

Checklist: Patching, Admin Panels and Credentials

Patching. Confirm that the store platform, its plug-ins and any automation or agent tools run supported versions, and list any component the vendor no longer supports.

Admin and control panels. Keep administration pages, staging sites and support tools off the public internet, or restrict them to a VPN or a fixed list of addresses. The operator’s own panels were found through internet scans, so visibility is the first exposure to check.

Uploads. The operators’ goals included uploading a web shell, so check that upload features accept only the file types the store needs.

Credentials. Rotate administrator, database and API passwords, and remove keys from configuration files and test tools. Treat any secret that sat in an exposed tool as compromised until it has been rotated.

A low cost per attempt lets one operator work through many sites.

Checklist: Monitoring, Vendors and What Happens Next

Monitoring. Review web server and admin logs for new administrator accounts, unfamiliar files in upload folders and bursts of automated requests. Set alerts for changes to checkout and payment scripts.

Vendor questions to put in writing: which components are patched and how quickly; whether admin panels can be reached from the internet; how uploads are checked; how long logs are kept; and how soon the vendor will report a breach of a site it hosts or runs for you. Cummins’s statement concerned a vendor’s website, so third-party pages belong on this list.

As of 19 October 2026, NorForge said it is seeking takedowns of the exposed panels and working with Reuters to notify victims, especially those that appear to have been compromised.

Photo: YouTube — Purdue Engineering · CC BY 4.0 · via Wikimedia Commons