NorForge and Reuters: a Chinese-speaking hacker used autonomous AI agents on the open-source Cairn platform to breach 100+ company sites, including Deere, SharkNinja and Cummins, at about $50 in tokens per hack

Why it matters

【Key points】

NorForge principal threat researcher Snorre Fagerland published "Inside Cairn" on Oct 19, and Reuters ran an exclusive the same day (about 18:10 CST). A Chinese-speaking hacker handed almost the whole job to AI agents. Starting Sept 25, the agents went after e-commerce sites in the US, Canada, Australia and Japan, tried more than 1,200 and got into over 100 companies. Reuters identified Deere, SharkNinja and Cummins among them.

The hacker gave Cairn, an open-source agent platform, intrusion instructions of under 100 Chinese characters. The agents then probed on their own for unauthenticated RCE and planted webshells, taking about 23 hours per success. Fagerland estimates the campaign mixed DeepSeek and Claude Code and spent about $5,000 in tokens, roughly $50 per breach. NorForge found it by scanning for unsecured Cairn panels: 20+ likely malicious, leaking hundreds of secrets, 11% verified valid.

Deere says it found "no indication that sensitive information was accessed." SharkNinja says a standalone support site was hit and contained. Cummins is investigating a third-party vendor site. Many "successes" are the agents' own claims; NorForge confirmed at least one live webshell. Cairn's author says it "was never a hacking tool."

【Verifiable】

NorForge: https://norforge.com/blog/inside_cairn

Reuters (via Investing.com): https://www.investing.com/news/stock-market-news/exclusivehow-one-hacker-used-ai-agents-and-a-few-thousand-dollars-to-break-into-scores-of-sites-4956846

【Our read】

1. Rare field evidence: a real criminal campaign where agents did recon-to-intrusion mostly alone, at tens of dollars per breach.

2. Victims were mostly peripheral sites, data loss is unclear, and agent-reported wins may overstate scale.

3. Commercial models plus open orchestration are enough, so vendor usage policies alone won't stop this.