Cairn AI Agents Breached 100+ Companies for ~$5,000 in Tokens

A single operator pointed an army of AI agents at more than 1,200 websites, broke into over 100 companies — John Deere, SharkNinja and Cummins among the names Reuters confirmed — and paid roughly $5,000 in model tokens to do it. The engine was not a bespoke piece of malware. It was Cairn, an open-source autonomous problem-solving platform, driven by off-the-shelf models and left wide open on the internet. The autonomous penetration-testing engine most of the industry still treats as a research demo is now a commodity, and it is being aimed at storefronts.

Developing story — first published 15:08 CEST (13:08 UTC), October 20, 2026. Updated as Norforge, Reuters and the affected vendors publish more.

What happened

Norforge threat researcher Snorre Fagerland was scanning the internet for exposed instances of Cairn — the same autonomous agent framework a Gambit Security report had flagged in September as part of a campaign against online retailers — and found that attackers had left their Cairn control panels sitting on the open internet, frequently without authentication. Some even exposed the SSH logins to their backend staging hosts. From those panels, Norforge could read the attackers' entire operation: targets, goals, step-by-step agent reasoning, harvested credentials, and results.

Reuters, which worked with Norforge to notify victims, reported that the largest cluster breached more than 100 companies, naming John Deere, SharkNinja and Cummins (via The Next Web). Deere said it took remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the activity hit a standalone product-support site and was contained. Cummins said it was investigating a possible attack on a website run by one of its vendors.

Norforge sorted the activity into three clusters:

	Cluster 1	Cluster 2	Cluster 3
Language	Chinese	English	English
Panels	14	10	1
Projects	1,100+	not stated	59
Targets	US, Japan, Australia e-commerce and payment infrastructure	Merchant payment, gray-market and pharma sites; a carding site; African commerce	Small shops and large US commercial platforms
Goal	Persistent access via webshells for later monetization	Credit-card and crypto theft	Shell, admin-panel and database access

Norforge assessed all three as financially motivated, with no obvious state sponsorship.

What Cairn is, and why it matters

Cairn is a general-purpose, state-based problem-solving engine: an operator defines a project with an origin (the starting point) and a goal (the desired end state), and a swarm of agent workers moves from one to the other. At each step an agent posts an intent — what it has decided to do next — and the facts it discovers go onto a shared blackboard that every worker can read, and that a human operator can nudge with hints. Cairn can render the whole thing as a graph.

Nothing about that is inherently malicious — it is a reasonable description of how an autonomous red team works. That is exactly the point. Pointed at a target with the goal "find a way to run code on this shop and plant an uploader webshell," the same architecture is an autonomous exploitation engine. The workers Norforge found were named things like claudecode_deepseek-v4.1-flash and pi_openrouter_deepseek — commodity models reached through OpenRouter, not a self-hosted system the operator had to build. The barrier to running a tireless, parallelized offensive campaign is now a config file and a model budget.

The economics inverted

The reason this story matters more than any single breach is the cost curve. From the exposed panel data, Norforge reconstructed the numbers:

• ~$5 per task on average, including the projects that failed.
• ~$50 per successful breach by Fagerland's rough estimate — the whole 1,200-site campaign cost on the order of $5,000 in tokens.
• ~10% success rate, with many of the rest reaching partial goals or gathering intelligence for a later attempt.
• A little under 23 hours, on average, from origin to met goal for the largest cluster — about 140 recorded facts per successful project; one ran for more than five days.
• Attacker instructions were often trivial — in some projects nothing more than "fetch credit cards" or "fetch crypto."

You used to need a skilled operator, days of their time, and a reason to care about your specific shop. Now the operator writes one sentence, the agent runs for a day, and the marginal cost of trying your site is a few dollars. Economic obscurity — "we're too small to be a target" — was never a strong control. At $5 a task it is no control at all.

This is the same force behind the LLMjacking economy funding autonomous attacks: agentic offense is token-hungry, so attackers industrialize the compute. Here they simply paid for it, and it was cheap.

Who got hit, and how

The targeting was mechanical. For the largest cluster, Norforge found targets were ranked by traffic — sites in the 200,000 to 1.5 million range — pre-validated with Microsoft's Playwright browser-automation framework, then fed to Cairn with a goal of unauthenticated remote code execution and a non-command-executing uploader shell for durable access. One completed task pointed to an uploader webshell on a hardware-parts vendor's site that was still being served when Norforge looked.

The tooling recovered from an exposed agent workspace reads like a working pentester's kit: Playwright and Chromium, Nmap, OWASP Amass, dnsrecon, ffuf, PHPGGC, the rockyou wordlist, Docker — and a StyleSmuggler proof-of-concept for CVE-2026-75650, the Magento zero-day used to plant RCE backdoors, alongside a Magento 2.4.9 validation lab. The agents were not inventing novel exploits from nothing; they were competently chaining known techniques — which is precisely why automated penetration testing at machine speed is so effective against the long tail of unpatched e-commerce. Trufflehog run over the exposed panel data turned up hundreds of secrets, 11% of them verified as still valid.

This is the second-stage escalation of the autonomous AI skimmer campaign Gambit Security described a month ago: same class of tooling, now with named Fortune-scale victims and a researcher inside the attackers' own dashboards.

Remediation

If you run an e-commerce or payment platform, treat this as an active-threat hunt, not a backlog item.

1. Am I exposed? Inventory internet-facing shops and payment pages. Enumerate your real attack surface the way the agents did — unauthenticated endpoints, admin panels, file-upload paths. If you run Magento/Adobe Commerce, confirm you are patched for CVE-2026-75650 (StyleSmuggler); the agents carry a working PoC for it.
2. Hunt for the uploader webshell. The durable-access goal was a file-upload shell, often non-command-executing to stay quiet. Review web roots and upload directories for recently added or modified PHP files, unexpected handlers, and files whose timestamps don't match your deploy history. Check web-server and WAF logs for POST-based uploads to unusual paths.
3. Rotate every secret that touched an exposed surface. With 11% of harvested secrets verified valid, assume API keys, DB credentials and payment-gateway tokens reachable from a compromised host are burned. Rotate them after you have confirmed the host is clean, not before.
4. Detection signals, from published indicators only. Norforge reported the panels were commonly reachable on port 8000, hosted on specific ASNs, and shared a tell-tale bug: a domain normalizer that stripped an initial "w", mangling www. — so related target lists carried the same malformed hostnames. Norforge withheld the full IP list pending takedowns and will share it with verified researchers. Do not invent IOCs beyond what the vendor has published.
5. Watch the egress, not just the entry. A planted webshell and any card/crypto exfiltration produce network traffic — the uploader being fetched, the skimmer beaconing out. Detection on the wire catches the stage the log review misses.

What is not known yet

Reuters could not establish how much data, if any, was actually taken from the named victims; the companies' own statements range from "no sign of access" to "investigating." The full indicator set is deliberately withheld until takedowns complete. Attribution stops at "financially motivated," with a Chinese-language largest cluster and an English-language card/crypto cluster that Norforge believes may be Africa-based; no state nexus has been claimed. And because the panels were found by chance — exposed to the open internet — the clusters Norforge mapped are a floor, not a ceiling. Operators who secured their panels are, by definition, not in this dataset.

Where Zero Hunt fits

The uncomfortable lesson is that the attackers are running an autonomous red team against your perimeter, and the only honest way to know whether yours falls to it is to run a governed one first. That is what Zero Hunt is: an autonomous AI red team of coordinated agents — recon, exploit, web, credential, post-exploit — that generates a working exploit chain per target rather than replaying a catalog, backtested in the AI Gym before anything runs in production. It operates on-premise on its own models (no OpenRouter account to drain, no third-party model that can refuse, throttle or be switched off), with a human in the loop for every action that matters and every finding signed at write time. Run black-box, it asks the only question the vulnerability scanner can't: does an agent reach code execution on my shop, in under 23 hours, the way Cairn's did?

And because durable access and card exfiltration both cross the network, Zero Hunt's AI Traffic Analysis — a deep-learning model with four inference heads, trained on billions of PCAP sequences and running on the appliance GPU — is built to flag the uploader fetch, the skimmer beacon and the anomalous egress while the activity is happening, not in the next morning's SIEM digest. When one operator can rent a working offensive engine for $5,000, the defense has to run at the same speed and on the same ground.