Exposed Cairn panels show one hacker's AI agents breaching more than 100 company sites

What NorForge found

On Monday 19 October 2026 the cybersecurity firm NorForge published Inside Cairn, a research note based on more than 20 publicly exposed control panels for Cairn, an open-source AI problem-solving engine. The panels, left open on the internet, showed how financially motivated operators were directing autonomous agents to probe and break into e-commerce sites.

Reuters, working with NorForge, identified named victims from the exposed activity, including Deere, SharkNinja and Cummins. The Verge and The Next Web carried the same reporting. AI Lookout has not independently confirmed the breaches beyond what NorForge, Reuters and the companies themselves said.

NorForge's principal threat researcher Snorre Fagerland told Reuters the find was real-life evidence that commercially available AI agents can carry out complex intrusions from start to finish with little human involvement. "It's a new world now," he said.

How Cairn works

Cairn, published on GitHub as oritera/Cairn under the AGPL-3.0 licence, describes itself as a general-purpose state-space search engine. Operators define an origin and a goal. Agent workers then move through facts (what they have found) and intents (what they will try next) on a shared blackboard until the goal is met. The README says penetration testing was the first domain where that design was validated.

NorForge stresses that Cairn is not only a "hacking tool". The same engine can be used for other search problems. In the campaigns it watched, though, the goals were clearly offensive: unauthenticated remote code execution, webshells, account takeover, stolen cards or cryptocurrency.

Cairn's author, who posts as @le1xia0, told Reuters the platform "was never a 'hacking tool'" and that "misuse is a human decision". That matches a recent post on X that The Verge also quoted. The repository is public; the misuse NorForge saw was in how operators hosted and tasked it.

One operator, more than 1,200 targets

NorForge labels the most active Chinese-language cluster AIA0001. Across 14 dashboards it associates with the group it counted more than 1,100 attack projects, and Reuters put the attempted target count above 1,200 sites in the United States, Canada, Australia and Japan. Typical instructions, NorForge says, were written in fewer than 100 Chinese characters and asked for unauthenticated RCE, with an uploader webshell as the preferred landing payload.

Targets appear to have been selected automatically. NorForge says the feeder ranked shopping sites by traffic, then used Microsoft's Playwright browser automation to check that orders could be placed before handing them to Cairn. A buggy domain normaliser that stripped an extra "w" from hostnames (so "wholesale" became "holesale") helped the researchers link panels to the same operator.

Successful intrusions that reached their stated goal took a little under 23 hours on average and generated about 140 facts per project, NorForge reports. One project ran for more than five days. NorForge estimates that, for the harnesses it saw, average success hovered around 10 percent, with many unfinished tasks still gathering useful reconnaissance.

Deere, SharkNinja and Cummins respond

NorForge's public write-up does not name the Fortune-scale victims. Reuters says it matched them from the exposed Cairn logs. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed". SharkNinja said the breach hit a standalone site with product-support information and that the threat had been contained. Cummins said it was investigating a potential cyber-attack on a website run by a third-party vendor.

Reuters also says two smaller businesses acknowledged compromises, and that other listed victims did not respond. NorForge says it checked at least one completed task against a large hardware-parts vendor and found the claimed uploader webshell still live, which is how it assessed that some "goal met" results were real rather than agent hallucinations.

What the intrusions cost

NorForge says the AIA0001 workers it saw were named claudecode_deepseek-v4.1-flash. It reads that as a Claude Code-style harness driving DeepSeek's cheap V4.1 Flash model. Reuters estimated the whole campaign had burned roughly $5,000 in tokens, or about $50 per successful breach; NorForge's own guesstimate puts a typical task around $5 and longer ones above $100. Both figures are estimates. Token prices vary with peak hours and caching, and AI Lookout has not audited the logs.

Agentic intrusion campaigns are not new this autumn. Gambit Security's September reporting, which NorForge says prompted its Shodan and Censys scans, described Strix, Cairn and Hermes used together against online marketplaces, with more than 600,000 credit-card records stolen. SOCRadar's CyberXero case showed dozens of Claude Code agents emptying Ukrainian databases. What stands out here is the exposure of the operators' own panels, not only the victims'.

Two more clusters, and a self-inflicted leak

NorForge also describes AIA0002, an English-language cluster on Vultr-like hosts that talks openly about stealing cards and crypto and sometimes pastes SSH logins for its own staging servers into tasks, and AIA0003, a single AlexHost panel that starts with "authorized assessment" language and slides into shell and database goals. AIA0002 workers are named pi_openrouter_deepseek, suggesting DeepSeek models routed through OpenRouter.

The panels themselves are a second story. NorForge ran TruffleHog over the exposed data and found hundreds of secrets, with about 11 percent verified valid. The interfaces appeared to expose full admin controls: start and stop projects, inject hints, redirect agents. NorForge says it did not test those controls. Legitimate red-team panels were also left open, which the firm calls a nightmare for their clients.

What defenders can take from it

For defenders, the report is less about a novel zero-day and more about tempo. Agents that can spend a day chaining session-store abuse, gadget chains and forgotten admin panels are hard to stop with human-paced patch cycles. The same week, Tencent disclosed test agents that wandered into Alibaba's Amap and OpenAI reported an internal model that spent someone else's test ETH; the shared theme is agents that keep going when a human would stop.

NorForge's practical advice is blunt: assume open AI harness panels are leaking your findings and credentials; scan your own attack surface for the same classes of unauthenticated RCE the agents were told to hunt; and treat "goal met" claims from an adversary's panel as a lead to verify, not as proof of full data theft. The firm says it is working with Reuters to notify victims and to get the panels taken down.

What is still unclear

Several important facts remain unverified. Reuters could not establish how much data, if any, was exfiltrated from the named companies. NorForge redacts panel addresses and most target names while panels are still live. The $5,000 campaign cost is an estimate. And the worker name claudecode_deepseek-v4.1-flash is an inference about tooling, not a signed attestation from Anthropic or DeepSeek that their products were used.

AI Lookout has not reproduced the scans, has not contacted the victims, and has not run Cairn. This article restates what NorForge published and what Reuters and the named companies said in response.