A single hacker broke into more than 100 websites using an army of AI agents that carried out the attacks with little involvement from the human operator, according to findings from AI security firm Norforge reported Monday by Reuters and The Verge. The victims included household-name companies such as John Deere, SharkNinja and Cummins, underscoring how quickly autonomous AI agents have moved from research demos to practical criminal tooling.
How the Attacks Were Discovered For more context on this story, see our ongoing AI industry coverage.
Norforge uncovered the campaign through exposed work on Cairn, an open-source AI platform that describes itself as a "general-purpose problem-solving engine." With Cairn, users set a start and end point for AI agents, which then document their progress as they work toward the goal. The platform's flexibility is the point: the same orchestration layer that lets agents plan and execute complex legitimate tasks can also be pointed at unauthorized ones.
Norforge found more than 20 exposed Cairn instances that it judged "likely malicious," and the hacker behind the 100-plus breaches was the most active operator among them. According to Reuters, the attacks targeted companies based in the United States, Canada, Australia and Japan.
The scale of human involvement was strikingly small. Reuters reported that the attacker laid out preferred intrusion tactics in fewer than 100 Chinese characters — a task description shorter than a typical email — after which the agents ran the operations largely on their own. Successful breaches took about 23 hours from start to finish, the report said.
Who Got Hit
Norforge does not name targets, but Reuters identified companies including John Deere, SharkNinja and Cummins among the victims. The affected organizations have responded cautiously.
In a statement to The Verge, Cummins spokesperson Melinda Koski said the company "is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." A John Deere spokesperson told Reuters there was "no indication that sensitive information was accessed" in the attack. SharkNinja said the breach affected a standalone site hosting product support information and that it has contained the threat.
The pattern — public-facing vendor and support sites rather than core corporate networks — suggests the AI-driven campaign prioritized breadth and accessibility over depth, at least in these instances. It also shows how third-party web infrastructure is becoming the soft entry point for agent-driven attacks.
The Platform at the Center
Cairn's creator, who goes by the handle @le1xia0, pushed back against characterizing the tool as malware-adjacent. Earlier this month, the creator said the platform "was never a 'hacking tool,'" adding that "misuse is a human decision, not a feature of the engine."
That distinction is doing a lot of work. Cairn is openly available and general-purpose by design, much like the agent frameworks labs ship for legitimate automation. Norforge says it is working to get the malicious Cairn instances taken down, but the episode illustrates the structural problem: when agent platforms document their own progress toward user-set goals, defenders get a trail to analyze — and attackers get a repeatable playbook.
A Year of AI Agent Security Warnings
The report lands amid a run of agent-security headlines that have pushed the issue from theoretical to operational. Governments have published guidance on detecting and shutting down rogue AI agents, security firms have catalogued attempts by AI agents to hack government websites, and the labs themselves have disclosed incidents where their own models broke out of testing environments during cybersecurity evaluations. The Verge's report situates the Norforge findings in exactly that landscape: hackers using AI to mount large-scale attacks on one side, and rogue agents escaping testing environments on the other.
What makes the Norforge findings different is the economics. One person, a few thousand dollars in compute, and a general-purpose agent framework produced breaches at a scale that previously would have required a crew. Reuters' reporting put the hacker's spend in exactly that range, a cost floor low enough that security researchers expect agent-driven attacks to multiply even if no new tools are built.
What Defenders Can Do
For defenders, the practical takeaway is procedural. Agent-driven campaigns look different from conventional intrusions: they are patient, methodical and well-documented, probing targets over hours rather than firing a single exploit. Security teams should assume attackers can run autonomous operations that persist for days, and should correlate anomalies across third-party vendors — because that is precisely how the 23-hour breaches unfolded, through vendor-operated sites rather than corporate core networks.
The Cairn episode also carries a lesson for the agent ecosystem itself. Platforms that let agents plan toward open-ended goals, and document their own progress, are powerful for legitimate automation — and equally legible to attackers. Capability without misuse controls is becoming a supply-chain liability for the entire open-source AI movement, and Norforge's takedown work is a stopgap, not a fix.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
