One Hacker's AI Agents Broke Into 100+ Sites for About $50 Each

A hacker's AI agents breached 100+ company sites, including Deere and SharkNinja, for about $50 a hack. Here's how the Cairn campaign worked and how to defend.

TheTechLane cover: a glowing swarm of AI agent nodes streaming into a grid of website windows, a few of them breached in red, beside the headline AI Agents Hacked 100+ Sites for About $50 Each

A single Chinese-speaking hacker handed a hacking spree to AI agents and broke into websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins, for roughly $50 in AI tokens per successful break-in. The campaign surfaced on October 19 because the attacker left the agents' control panels wide open on the internet.

Here's what you need to know:

  • The agents tried more than 1,200 sites and successful intrusions took about 23 hours each, according to Reuters.

  • The whole spree burned an estimated $5,000 in tokens, with a worker labelled claudecode_deepseek-v4.1-flash doing the work.

  • Security firm NorForge found 20+ exposed panels for Cairn, an open-source agent platform, that it ties to malicious activity.

  • The open panels leaked hundreds of secrets, and 11% were still valid.

  • Deere says it has "no indication that sensitive information was accessed." Cummins is still investigating.

Stat card of the Cairn AI agent hacking campaign, more than 1,200 sites tried, more than 100 companies breached, about 23 hours and 50 dollars per successful hack

The campaign by the numbers, per NorForge and Reuters.

What Happened

NorForge principal threat researcher Snorre Fagerland published Inside Cairn, the firm's full report, on October 19. He went looking for AI "harness" dashboards on the Shodan and Censys scanners after Gambit Security found tools like Hermes, Strix and Cairn on an attacker's staging server in September. Most were locked. Cairn panels often weren't.

Cairn calls itself a "general-purpose problem-solving engine," as The Verge notes. Each task is a project with a start point and a goal. Agents post "facts" (what they found) and "intents" (what they'll try next) to a shared blackboard until they hit the goal.

The busiest group, which NorForge tags AIA0001, ran more than 1,100 attack projects across 14 panels, mostly against US, Japanese and Australian targets. A typical task fed the agents real shopping sites with 200,000 to 1.5 million visitors, already checked with Playwright to confirm orders could be placed. The goal was unauthenticated remote code execution, and the payload was a file-uploader web shell for later access.

NorForge didn't name victims. Reuters did, after reviewing the hacker's Cairn activity itself. In its exclusive report by Raphael Satter, Reuters says the operator started on September 25, gave instructions in fewer than 100 Chinese characters, and had agents attempt more than 1,200 sites by late last week.

The agents weren't just spraying exploits. When one big company's main app held up, they dug through records for related infrastructure, found a public control panel and eventually got the server to run commands. "It's not script kiddie stuff," Fagerland told Reuters.

Deere said it took "necessary remediation actions." SharkNinja said only a standalone product-support site was hit and the threat was contained. A Cummins spokesperson told The Verge it is "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Reuters couldn't confirm how much data, if any, was taken.

Why It Matters

This is the clearest public look yet at an AI agent running intrusions end to end with almost no human input. Fagerland told Reuters he'd assumed hacker agents would still need supervision. "It's a new world now," he said.

The economics are the scary part. NorForge puts the average task at around $5 including failures, with a success rate near 10%. It warns the cost estimate "could be off by a clear margin." Either way, that's cheap enough for one person to run hundreds of break-in attempts in parallel.

It also isn't a one-off. Reuters reports that Gambit Security tied an agent-driven spree in September to breaches at 25 companies and the theft of at least 600,000 credit card records. As The Next Web points out, a second English-language cluster openly tasked agents to "fetch credit cards" or "fetch crypto."

There's a twist, too. The attackers were sloppy. Their unprotected panels exposed full admin controls plus credentials they had harvested, which put victims at even more risk. NorForge also found legitimate red-team pentests sitting on open panels.

What It Means for Developers

The agents mostly went after classic web bugs, not exotic AI tricks. NorForge's validated case chained write access to an exposed memcached session store, unsafe PHP deserialization and a gadget chain in legacy Zend Framework code. That's a patching and hardening problem you can work on today.

Flow diagram of the Cairn AI agent attack pipeline from target feed to uploader web shell, with a defender step under each stage

How the busiest cluster's pipeline worked, and where defenders can break it.

  • Hunt the bug classes they asked for. AIA0001's brief listed login SQL injection, unauthenticated endpoints, file uploads, deserialization, auth bypass, SSTI and SSRF. Audit those first.

  • Lock down upload paths. Block executable files in upload directories and alert on new .php files in the web root.

  • Don't expose internals. Memcached, Redis and admin panels shouldn't be reachable from the internet, and that includes the forgotten ones run by vendors.

  • Patch e-commerce stacks fast. NorForge found a Magento proof-of-concept and validation lab in one agent's toolkit, so outdated storefronts are clear targets.

  • Put auth on your own agent dashboards. If you run Cairn or any other agent harness, never leave its web UI open on a public port. Secrets you paste into an agent end up in its logs and its UI.

  • Rotate keys you've ever shared with an agent. Our coverage of the OpenCode console breach shows how quickly leaked AI keys get abused.

What's Next

NorForge says it's working with Reuters to notify victims and is trying to get the malicious panels taken down. It admits that "might not be possible," depending on how hosting providers respond.

Big questions remain. Reuters couldn't establish what data left the breached sites, and most other victims in the Cairn data didn't respond. NorForge also notes that the claudecode_deepseek-v4.1-flash worker name only "could mean" a Claude Code harness running DeepSeek's model. Neither Anthropic nor DeepSeek has commented in the reports we found. For context on that model, see our look at DeepSeek's V4.1-Flash update.

Cairn's creator, le1xia0, said on X that the platform "was not designed for hacking attacks," according to Reuters, and that "misuse is a human decision, not a feature of the engine," according to The Verge. Expect pressure on open-source agent projects to ship safer defaults, such as authentication on by default.

FAQ

What is Cairn?

Cairn is an open-source multi-agent "problem-solving engine." You set a starting point and a goal, and AI agents work toward it step by step. NorForge found attackers using it to automate website break-ins.

Which companies were affected?

Reuters identified Deere, SharkNinja and Cummins among more than 100 victims. Deere says no sensitive data appears to have been accessed, SharkNinja says only a support site was hit, and Cummins says it's investigating a vendor-run site.

Did DeepSeek or Anthropic build the attack?

No. The attacker used an open-source harness with commercially available models. NorForge says the worker name suggests Claude Code driving DeepSeek V4.1 Flash, but it hasn't confirmed that setup.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane. Learn • Build • Share Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.