Skip to content

AI cyberattack: agents broke into more than 100 companies

An AI cyberattack hit more than 100 companies, including Deere and SharkNinja: agents in Cairn worked almost alone, at about $50 per successful break-in.

Piotr Sobolewski4 min read

This article in other languages:العربيةDeutschEspañolFrançaisItaliano日本語Polski简体中文

In this article
  1. How did this AI cyberattack work?
  2. How much did it cost and which models were used?
  3. What do the affected companies say?
  4. Why is this making waves?
  5. FAQ

On October 19, Reuters’ Raphael Satter described how a Chinese-speaking hacker broke into the websites of more than 100 companies in a few weeks, among them Deere, SharkNinja and Cummins. The same day, Snorre Fagerland of NorForge published a report on the Cairn platform behind this AI cyberattack: AI agents, not a human, did almost all of the work.

How did this AI cyberattack work?

Cairn is an open-source platform where you give AI agents a goal and a task, and they work their way toward it step by step. Each task is a separate project, the agents write their findings on a shared board, and the operator can add hints. Fagerland stumbled on the whole thing while scanning the internet for publicly exposed Cairn panels. The operators simply hadn’t secured them (the report only notes that “securing their own infrastructure does not appear to be among their strengths”).

According to the NorForge report:

  1. More than 20 panels were most likely used for crime. The researcher split them into three groups.
  2. The largest group, Chinese-speaking, ran 14 panels and more than 1,100 attack projects against online stores in the US, Canada, Japan and Australia. The agents were told to find a way to execute code remotely and leave a file on the server that lets them upload more files, which also means persistent access.
  3. The second group, English-speaking, got tasks along the lines of “fetch credit cards” or “fetch crypto”.
  4. A successful break-in took the agents just under 23 hours on average, and one project ran for more than five days.
  5. The average success rate was about 10%.

According to Reuters, by the end of last week the agents had tried to get into more than 1,200 sites.

How much did it cost and which models were used?

This is where it gets most interesting. Fagerland estimates the whole campaign used about $5,000 worth of tokens, roughly $50 per successful break-in. In the report, the average cost of a single task (failed ones included) is about $5, with the caveat that the uncertainty is “considerable”.

The largest group’s tasks ran through a worker called claudecode_deepseek-v4.1-flash. According to NorForge, this may mean the Claude Code agent harness powered by the cheap DeepSeek V4.1 Flash model. The second group used pi_openrouter_deepseek workers, most likely the Pi framework with DeepSeek models via OpenRouter. That is a reading of the names, not a confirmation from Anthropic or DeepSeek, since neither company commented in the Reuters story.

Interestingly, the panels gave away more than the attack targets. They held hundreds of secrets: passwords, API keys and other credentials. Trufflehog confirmed that 11% of them still worked. The exposed panels also contained projects from legitimate penetration-testing firms, together with their clients’ data.

What do the affected companies say?

The victims were named by Reuters, not by the NorForge report. According to their statements:

  1. Deere took “necessary remediation actions” and has no indication that anyone accessed sensitive data.
  2. At SharkNinja, the target was a separate product support information site, and the threat has been contained.
  3. Cummins is looking into a report of a possible attack on a site run by a third-party vendor.

Reuters couldn’t determine how much data (if any) was stolen. Cairn’s author, who goes by le1xia0 on X, wrote that the platform “was not designed for hacking attacks” and that harmful use was never his intention.

Why is this making waves?

Because it’s more proof that AI agents are breaking into real companies with almost no human oversight. Fagerland told Reuters he had assumed such agents would still need at least some supervision, and that the technology is already past that point. He put it briefly: “It’s not script kiddie stuff” and “The development in this field is astounding”.

The backdrop is worrying. Reuters notes that in August Gambit Security described a group that broke into seven organizations with the help of an AI tool, and in September an agent campaign that hit 25 companies and at least 600,000 credit card records. According to Bitsight, autonomous agents are also coming up more and more often on criminal forums.

A few days ago I wrote about the OpenCode leak, where one of the tool’s co-creators called it a “whole new world with ai powered hacking”. Apparently he wasn’t exaggerating :(

FAQ

Was it Claude Code that broke into the companies?

We don’t know for sure. The worker’s name suggests the Claude Code harness with the DeepSeek V4.1 Flash model, but that’s only NorForge’s interpretation. The model itself is DeepSeek, and Claude Code would be (just another) layer that calls the tools.

What is Cairn?

It’s an open-source platform that coordinates AI agents working toward a single goal, with a shared board for findings. According to its author it wasn’t built for hacking, but the NorForge report calls it outright an “AI-powered hacking system”.

How much does an AI cyberattack cost?

In this campaign, according to Fagerland’s estimates, about $50 in tokens per successful break-in and about $5 for every task, failed ones included. Fagerland himself stresses that these are estimates with a lot of uncertainty.