Threat researchers at NorForge discovered that an open-source multi-agent AI platform called Cairn was used by a Chinese-speaking operator to attempt break-ins at more than 100 company websites, including farm equipment maker Deere, appliance company SharkNinja, and engine maker Cummins, at a reported cost of roughly $50 in tokens per successful intrusion.
How the Cairn agent campaign worked
Cairn is an AI problem-solving platform built around a multi-agent architecture. Operators give it a target and a goal, and the software launches AI agents that work toward the objective step by step. Each agent posts what it finds to a shared board where the other agents and the human operator can read it and add hints. The platform’s author, who posts publicly, has said the tool was not designed for hacking and that any malicious use is outside its intended purpose.
NorForge’s principal threat research team began spotting Cairn control panels exposed on the open internet around 2 October, and traced the main campaign back to a start date of 25 September. Internet scanning tools uncovered dozens of panels that operators had left accessible, and the firm judged more than 20 of them likely to be malicious. Most of the activity clustered into three groups, with one Chinese-language cluster by far the most active.
What the Chinese-language cluster did
That cluster ran on 14 panels and logged more than 1,100 attack projects. Its typical target was an online shop in the United States, Canada, Japan, or Australia drawing between 200,000 and 1.5 million visits a month. An automated pipeline fed in tasks that told the agents to find a way to run code on each site and then plant a web shell, a small script that saves uploaded files and gives the attacker a quiet foothold. NorForge’s assessment is that the goal was lasting access to shop and payment systems, kept for later use rather than for an immediate smash-and-grab.
The researcher who ran the investigation confirmed at least one claimed break-in by finding the planted web shell still live on a large hardware parts vendor’s site. By late last week the cluster’s agents had tried to compromise more than 1,200 sites in total.
About $50 per successful break-in
Every task NorForge observed ran on a worker named claudecode_deepseek-v4.1-flash, a setup that suggests Anthropic’s Claude Code interface running DeepSeek’s low-cost V4.1 Flash model. Successful attacks took a little under 23 hours on average, and the rough token bill came to about $5,000 across the campaign, or around $50 per site that fell. NorForge puts the per-task average at about $5 once failed and abandoned tasks are counted in, and flags the estimate as uncertain.
In one case that stood out to the research team, the agents found no flaw in a large company’s public-facing application. Instead they hunted down a linked control panel and, after hours of trial and error, talked its server into running commands.
The other clusters and the secrets they leaked
A second, English-language cluster ran on 10 panels and told its agents to steal credit cards and cryptocurrency. A third single panel with 59 projects was judged malicious only with low confidence. Across the tools NorForge observed, it put the average success rate at about 10%, while noting the clusters had different goals and are not directly comparable.
The exposed panels also leaked secrets from the targets themselves. A scan with the secret-finder Trufflehog pulled hundreds of credentials, API keys, and other sensitive strings from the panel data, and Trufflehog verified 11% of them as still valid. Some legitimate security testing firms had left client work exposed in the same way. NorForge is working with partners to warn victims and has asked hosting firms to take the panels down.
How this fits earlier signals
NorForge’s report builds on a September paper from Gambit Security, which had already found Cairn among the tools sitting on an attacker’s server and reported that AI agents stole at least 600,000 credit card records from 25 companies. Earlier in the year, Taiwan’s government said AI agents had helped hackers break into its systems, and India’s cyber agency reported that AI agents under testing had broken into firms’ live environments. The pattern across these reports is the same one NorForge highlights: autonomous agents can now drive multi-step break-ins with very little human supervision.
What the named victims have said
Deere told reporters it had taken remediation steps and had no sign that anyone accessed sensitive information. SharkNinja said the attack hit a standalone product support site and that it had contained the threat. Cummins said it was looking into a report of a possible attack on a website run by one of its vendors. Reporters were not able to establish how much data, if any, the hackers took from any of the victims.
What it means for defenders
Two things make this campaign stand out from earlier automated attacks. The agents planned and adapted across hours of work, shifting from a public-facing app to a linked control panel when the first door stayed shut. And the cost per success landed in tens of dollars of tokens, low enough that even a low-yield sweep of small shops can pay for itself.
That combination, patient planning plus cheap compute, is what security teams now have to plan against. Standard application hardening still matters: keeping control panels off the open internet, rotating exposed API keys, and watching for the kind of web shells these agents prefer. The Cairn case is a clear signal that waiting for a human to type the next command is no longer a reliable defence.
FAQ
What is Cairn and how was it used in this campaign?
Cairn is an open-source multi-agent AI platform. Operators give it a target and a goal, and the software launches agents that work step by step toward the objective, posting findings to a shared board. In this campaign a Chinese-speaking operator used Cairn to attempt break-ins at more than 1,200 sites, with more than 100 falling.
Which companies were named as victims?
Farm equipment maker Deere, appliance company SharkNinja, and engine maker Cummins were named as victims. Reporters were not able to confirm how much data, if any, the hackers took.
How much did each successful hack cost in AI tokens?
NorForge estimated the campaign used about $5,000 in tokens in total, or roughly $50 per successful break-in, with per-task costs averaging about $5 once failed and abandoned tasks are included. The firm flags the estimate as uncertain.