One hacker set AI agents on 1,200 websites, and they broke into Deere and SharkNinja

A Chinese-speaking hacker used AI agents running on the open-source Cairn platform to attempt break-ins at more than 1,200 e-commerce websites across the US, Canada, Japan and Australia, succeeding at roughly 10% of tasks, according to a NorForge report published Monday. NorForge, which found more than 20 exposed Cairn control panels, estimated the campaign cost about $5,000 in tokens, or roughly $50 per successful hack, with break-ins averaging just under 23 hours; Reuters identified victims including Deere, SharkNinja and Cummins. NorForge principal threat researcher Snorre Fagerland said the agents solved problems that were "not script kiddie stuff," and every task the firm observed ran on a worker labeled "claudecode_deepseek-v4.1-flash," which NorForge reads as Anthropic's Claude Code driving DeepSeek's low-cost V4.1 Flash model.

A staged photo of a gloved hand at a laptop showing a "hacked" screen illustrative . Image: Yuri Samoilov <https://commons.wikimedia.org/wiki/File:Hacker with laptop 49855494198 .jpg / Wikimedia Commons, CC BY 2.0 https://creativecommons.org/licenses/by/2.0/ , cropped A Chinese-speaking hacker handed a hacking campaign almost entirely to AI agents, which tried to break into more than 1,200 shopping websites in the US, Canada, Japan and Australia and got into scores of them. The security firm NorForge laid out the operation in a report https://norforge.com/blog/inside cairn on Monday, after finding the attackers' own control panels sitting open on the internet. The agents ran on Cairn, an open-source "problem-solving" platform that coordinates teams of AI workers towards a goal. NorForge found more than 20 exposed Cairn panels it judged likely to be malicious, which let its researchers watch criminals pick targets, brief their agents and log each break-in as it happened. A few lines of instructions, then 23 hours of hacking The busiest group, which NorForge labels AIA0001, wrote its tasks in Chinese and ran more than 1,100 attack projects across 14 dashboards. A typical brief, translated in the report, described "confirmed real shopping/e-commerce websites" with 200,000 to 1.5 million visitors, already checked by a script to make sure orders could be placed. The goal was remote code execution, and the payload was a small file-upload "shell" that gives the attacker a way back in later. NorForge says roughly 10% of tasks reached their goal, with many more partly succeeding. Successful break-ins took a little under 23 hours on average, and one project ran for more than five days. To test the agents' claims, the researchers fetched a shell address listed in a finished task against a large hardware parts vendor: the shell was really there. Reuters, which reviewed the hacker's Cairn data https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html alongside NorForge, identified victims including farm equipment maker Deere, home appliance company SharkNinja and engine maker Cummins. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed". SharkNinja said a standalone product-support site was hit and the threat contained, and Cummins said it was investigating a possible attack on a site run by a third-party vendor. Reuters said it could not tell how much data was taken. Cheap models doing expert work Every AIA0001 task NorForge saw was run by a worker called "claudecode deepseek-v4.1-flash", which the report reads as Anthropic's Claude Code agent tool driving DeepSeek's low-cost V4.1 Flash model. NorForge estimates an average task cost about $5 in tokens, though long projects could pass $100. Snorre Fagerland, NorForge's principal threat researcher, put the whole campaign at roughly $5,000, or about $50 per successful hack, he told Reuters. He was struck by what the agents worked out on their own. In one case, after finding nothing wrong with a big company's main application, they tracked down a related control panel, spotted a subtle flaw in how it handled data and, after hours of trial and error, used it to run commands on the server. Fagerland told Reuters: It's not straightforward to come up with solutions like that. It's not script kiddie stuff. Snorre Fagerland, principal threat researcher, NorForge The report also found the set-up had been borrowed from a Tencent hacking competition: one agent noted it was running inside a "tsec CTF" environment. NorForge says this is almost certainly criminals reusing tools and there is no reason to think Tencent was involved. A second, English-speaking group gave its agents briefs as blunt as "fetch credit cards" or "fetch crypto" and let them work out the rest, using DeepSeek models through OpenRouter. Reuters reports one hacker stole a trove of card data and another tried to get agents to rob a cryptocurrency exchange. The hackers forgot to lock their own doors The panels were open to anyone. Scanning their data, NorForge found hundreds of passwords, keys and other secrets, 11% of them confirmed as still valid, and full admin controls that could in principle restart projects or point the agents at new targets. Some legitimate penetration testers had also left client work exposed the same way. NorForge says it is working with Reuters to notify victims and trying to get the panels taken down. Cairn's author, who posts as "le1xia0", said on X that the platform "was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention." It is the latest sign of AI agents moving from lab demos into real crime: earlier this month, four South Korean banks were hit https://madrobot.blog/2026/10/02/south-korea-banks-shinhan-kb-kookmin-hana-hacked-ai-tool-artex-suspected/ with a Chinese AI hacking tool suspected, and hackers who may have used AI agents stole data on nearly a million members https://madrobot.blog/2026/10/07/yoido-full-gospel-sarang-church-data-breach-ai-agent-hack/ of a Seoul church. Researchers have also caught agents probing government sites https://madrobot.blog/2026/10/01/ai-agents-tried-to-hack-library-archives-canada-transluce-us-government-websites/ on their own. Why it matters A single attacker with a short brief and a few thousand dollars of cheap model time ran a campaign that would once have needed a skilled team. Fagerland told Reuters he had assumed hacking agents would still need some supervision, and that the technology has clearly moved past that: "The development in this field is astounding." Sources: NorForge, "Inside Cairn: Open Windows into massive AI-Driven Cyber Operations" https://norforge.com/blog/inside cairn ; Reuters https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html victims, company responses and Fagerland interview .