One hacker used Cairn AI agents to breach 100+ company websites, Deere and SharkNinja included, for about $50 per break-in. How to check yours.
The hacker wrote fewer than 100 Chinese characters of instructions and let a team of AI agents do the rest. By the time researchers found the operation, those agents had tried more than 1,200 websites and broken into more than 100 companies, including John Deere and SharkNinja. The estimated bill came to about $50 per successful break-in.
That's no longer a thought experiment about what AI might do to cybersecurity one day. It happened between late September and mid-October 2026, and it was found only because the attackers left their own control panels open on the internet.
The Cairn AI hacking campaign is a set of automated intrusions in which attackers used Cairn, an open-source multi-agent AI platform, to break into e-commerce and corporate websites with very little human effort. NorForge principal threat researcher Snorre Fagerland began spotting exposed Cairn control panels around October 2, 2026. The campaign had started on September 25.
Cairn calls itself a "general-purpose problem-solving engine." You give it a project with a goal, and a group of AI agents works toward that goal step by step, posting what they intend to do and what they find on a shared "blackboard." It can be used as an autonomous penetration testing engine, which is exactly how the attackers used it, minus the permission.
Cairn's author, who posts as le1xia0, said on X that the platform "was never a 'hacking tool'" and that "misuse is a human decision, not a feature of the engine." Nobody has reported a flaw in Cairn itself. The problem is what people chose to point it at.
NorForge judged more than 20 exposed panels likely malicious and grouped most of them into three clusters:
About 10% of attempts succeeded. In a numbers game run by software, 1 in 10 is plenty.
"It's not script kiddie stuff." — Snorre Fagerland, NorForge, to Reuters
The agents broke in by finding a way to make a target's server run commands, then planting a simple webshell to keep coming back. According to NorForge's findings as reported by The Next Web and SecurityWeek, the workflow looked like this:
The most telling detail: in one case, the agents found nothing wrong with a large company's main public website. So they went sideways, found a linked control panel, and after hours of trial and error got that server to run commands.
That's what a patient human attacker does. The difference is that an AI agent doesn't get bored after hour three.
Look at where the named victims were hit. SharkNinja said the attack reached a standalone product support site, and Cummins is looking into a possible attack on a website run by one of its vendors. Deere said it saw no sign that sensitive information was accessed. Reuters could not establish how much data, if any, was taken. These aren't crown jewels. They're side doors.
No. In September 2026, Gambit Security reported a financially motivated attacker who used three open-source AI tools, Strix for finding vulnerabilities, Cairn for exploitation and Hermes for orchestration, against online retailers. That campaign compromised at least 27 organizations, planted card skimmers on several online stores and took more than 600,000 payment card records. Gambit put the attacker's AI spend at roughly $25 per target.
Two reports, two months, the same conclusion: autonomous offensive tooling is out of the lab and running against real businesses.
You're exposed if you run any internet-facing web application that you haven't recently tested, and that's especially true of the ones you forgot you had. Automated attackers don't care about brand size, only reachable surface. Ask yourself (or your clients):
You protect your websites from AI hacking agents the same way you protect them from human attackers, except you now have to do it everywhere and more often. Your forgotten subdomain used to be safe because nobody bothered. That excuse is gone.
.php, .jsp or .aspx files and unexpected upload handlers in web directories.The honest version is this: the attackers in this story ran an autonomous pentest against their victims. KinoSec runs one against you, with your permission, before they do.
KinoSec is an autonomous AI penetration testing platform for web apps, external networks and Active Directory. Point it at your domain and it does the reconnaissance (finding the support portal, the forgotten admin panel, the staging box), probes for paths to code execution and exposed functionality, chains findings across surfaces the way that agent pivoted from a clean website to its linked control panel, and writes up what it found with plain-language remediation.
For MSPs and MSSPs, that's the practical answer to a new problem: attackers can now afford to test every client's every website, so you need to as well. You can run it continuously across a client portfolio instead of once a year on the flagship app.
KinoSec doesn't replace webshell hunting on a server that's already compromised, and it doesn't block attacks in real time. What it does is answer the question this campaign makes urgent: "If someone pointed an AI at us tonight, what would it find?"
Cairn is an open-source AI platform that coordinates multiple AI agents toward a goal, sharing their progress on a common "blackboard." It can be used as an autonomous penetration testing engine. In October 2026, NorForge found threat actors running Cairn to automate attacks on websites. Its author says it was not designed as a hacking tool.
Reuters reported on October 19, 2026 that a Chinese-speaking hacker using Cairn breached more than 100 company websites, including John Deere and SharkNinja, and that Cummins was looking into a possible attack on a vendor-run site. Deere said it saw no sign of sensitive data access, and SharkNinja said the affected standalone support site was contained. NorForge itself did not name victims.
NorForge researcher Snorre Fagerland estimated about $5,000 in AI tokens in total, or roughly $50 per successful break-in, and stressed the figure is uncertain. A separate September 2026 campaign reported by Gambit Security cost about $25 per target. Either way, automated web attacks now cost far less than a human attacker's time.
Autonomous pentesting doesn't block attacks, but it finds the same exposures AI hacking agents look for (forgotten sites, open admin panels, paths to code execution) so you can fix them first. Because it runs on demand, it can keep pace with attackers who now test thousands of sites cheaply. Platforms like KinoSec do this across web apps, external networks and Active Directory.