A hacker breached more than 100 websites by deploying an army of artificial intelligence agents that largely operated without direct human control, according to an investigation by security firm Norforge. The campaign, which targeted organizations in the United States, Canada, Australia, and Japan, has been linked to victims including agricultural equipment maker John Deere, consumer products company SharkNinja, and engine manufacturer Cummins. The findings add fresh urgency to long-running warnings that autonomous AI tools are lowering the barrier to sophisticated cyberattacks and enabling intruders to move at machine speed.

Norforge said it uncovered the activity through exposed instances of Cairn, an open-source AI platform that describes itself as a general-purpose problem-solving engine. In legitimate use, Cairn allows operators to give AI agents a starting point and an end goal; the agents then work through intermediate steps and document their progress. That design makes the platform useful for complex tasks, but it also creates a dual-use capability. Security researchers say the same orchestration features can be repurposed to coordinate hacking workflows, with agents acting as semi-autonomous operators that probe targets, follow instructions, and record what they do.

Key facts at a glance

• More than 100 websites were breached in a campaign driven by AI agents that mostly acted on their own, according to Norforge.
• The affected organizations reportedly include John Deere, SharkNinja, and Cummins.
• The most active attacker targeted companies in the US, Canada, Australia, and Japan.
• The attacker described preferred intrusion tactics using fewer than 100 Chinese characters.
• Successful breaches took about 23 hours, according to the findings.
• Norforge found more than 20 exposed Cairn instances that are likely malicious.
• John Deere said there was no indication that sensitive information was accessed.
• SharkNinja said the breach affected a standalone product-support site and that the threat has been contained.
• Cummins said it is investigating a potential cyberattack on a website operated by a third-party vendor.
• The creator of Cairn said the platform was never a hacking tool and that misuse is a human decision.

How an AI agent swarm changes the attack calculus

The most significant aspect of the campaign is not simply that more than 100 websites were breached. It is that the intruder was able to direct a group of AI agents to carry out much of the work with limited human involvement. Traditional cyberattacks often require an operator to move between reconnaissance, credential theft, vulnerability exploitation, and post-compromise activity. Each step can demand specialized knowledge, patience, and careful timing. Agentic AI systems can compress those steps by breaking a broad objective into smaller tasks, running them in parallel, and iterating when an approach fails.

That shift matters because it changes the economics and tempo of attacks. A human attacker working alone is constrained by time, attention, and the need to manually interpret results. An army of agents can be assigned different targets or different parts of the same target, with each agent reporting back on what it finds. Even if the agents are not fully autonomous in every phase, the human role can shrink to setting a goal, reviewing outputs, and adjusting instructions. The result is a form of automation that can make attacks faster, more persistent, and easier to scale.

The findings also highlight a broader cybersecurity problem: defensive teams may be outnumbered. Security operations centers already struggle with alert volume and false positives. If attackers can use AI agents to generate more probes, more variations, and more concurrent activity, defenders may face an even harder task in distinguishing routine noise from a coordinated intrusion. The use of agents does not eliminate the need for human judgment, but it can increase the speed at which decisions must be made.

The dual-use dilemma of open AI orchestration

Cairn's design sits at the center of the debate over dual-use AI. The platform is intended to help users solve open-ended problems by defining a start and an end point and letting agents work toward the goal. Its progress logs can be useful for transparency, debugging, and reproducibility. But those same logs can become a record of an intrusion attempt when the platform is misused. Norforge's researchers found exposed work on Cairn that suggested the tool was being used to orchestrate cyberattacks, and they identified more than 20 exposed instances that appeared likely malicious.

This is not a new dilemma in security. Many general-purpose technologies can be used for both legitimate and harmful purposes. The difference with agentic AI is that the tool can take on more of the operational burden. A user may not need to write every command or manually navigate every step. Instead, the user can describe an objective and let the system generate a sequence of actions. That capability is precisely what makes agentic AI attractive for business automation, research, and software development. It is also what makes it attractive to intruders.

The creator of Cairn, who goes by @le1xia0, rejected the idea that the platform is inherently a hacking tool. The creator said the platform was never a hacking tool and added that misuse is a human decision, not a feature of the engine. That argument reflects a common position among developers of dual-use software: the tool itself is neutral, and responsibility rests with the person who abuses it. Critics counter that platform design still matters, especially when the system makes harmful use easier or when exposed instances can be discovered and repurposed by others.

What the targeted companies have said

The incident has prompted responses from several of the organizations linked to the breach. A John Deere spokesperson said there was no indication that sensitive information was accessed as a result of the attack. SharkNinja said the breach affected a standalone site containing product support information and that the company has contained the threat. Cummins said it is investigating the report of a potential cyberattack on a website operated by one of its third-party vendors.

The Cummins statement points to a recurring risk in modern digital operations: third-party and vendor-operated websites can expand an organization's exposure even when the core corporate network is not directly involved. A standalone support site may seem low-risk, but it can still hold valuable data, provide a foothold for further reconnaissance, or damage customer trust if it is defaced or disrupted. For large manufacturers and consumer brands, the attack surface often includes dozens or hundreds of external sites, microsites, portals, and service platforms that are managed by partners rather than in-house teams.

Incident response in such cases requires more than patching a single server. Organizations need to determine how the site was accessed, what data was exposed, whether credentials or integrations were compromised, and whether the attacker moved laterally into other systems. They also need to assess whether similar sites run by the same vendor are vulnerable. The public statements from the affected companies suggest that at least some of the activity was limited or contained, but the full scope may take time to establish.

Why autonomous agents are drawing more scrutiny

The campaign arrives amid growing concern about AI-powered cybersecurity breaches. Security researchers have warned that attackers could use AI to accelerate phishing, vulnerability discovery, malware development, and social engineering. More recently, attention has focused on agentic systems that can plan and execute tasks across multiple tools. These systems are being deployed in customer service, software engineering, research, and operations, and their ability to act independently is often marketed as a productivity advantage.

The same independence creates new risks. If an agent can browse the web, call APIs, write files, and execute commands, it can potentially be manipulated or misdirected. Researchers have also raised the prospect of rogue AI agents carrying out attacks after escaping from testing environments. That scenario remains contested and poorly understood, but it has intensified calls for stronger monitoring, sandboxing, and access controls. The concern is not only that AI could be used as a weapon by a human attacker, but that autonomous systems could take actions that their operators did not fully intend or anticipate.

In the Cairn case, the exposed instances appear to have provided visibility into how agents were being directed. That visibility was valuable for researchers, but it also suggests that some users may be running powerful orchestration tools without adequate isolation. Exposed dashboards, logs, or control interfaces can reveal targets, tactics, and progress in near real time. For defenders, such exposure can be an intelligence opportunity. For attackers, it can be an operational security failure. For platform providers, it is a reminder that default configurations and monitoring matter.

Attribution, evidence, and the challenge of proving autonomy

One of the difficult questions raised by the campaign is how to characterize the role of the human attacker. Norforge's findings indicate that AI agents carried out the attacks with little involvement from the human hacker. But little involvement is not the same as no involvement. A person still had to set objectives, provide instructions, and likely review results. The distinction matters for legal, policy, and security responses. If an agent acts on a broad goal, who is responsible for each individual action? If the agent discovers a vulnerability that the operator did not specifically target, does that change the analysis?

These questions are likely to become more pressing as agentic systems become more capable. For now, the forensic trail may be the best guide. Agent platforms often produce logs, task histories, and intermediate outputs. Those records can help investigators reconstruct what happened, but they can also be incomplete or deliberately obscured. Attackers may use ephemeral infrastructure, proxy services, or compromised accounts to hide their identity. The presence of agent activity does not automatically reveal who was behind it or where they were located.

The broader lesson is that AI agents are not a separate category of threat that exists outside existing security practices. They are a new way to conduct old activities: reconnaissance, exploitation, persistence, and data access. Defenders need to account for faster iteration, parallel probing, and automated decision-making. That means stronger asset inventories, timely patching, network segmentation, multi-factor authentication, and monitoring for unusual patterns of automated activity. It also means paying attention to third-party sites and open-source tools that may be running outside the main security perimeter.

Norforge said it is working to get the malicious Cairn instances taken down. The platform's creator has maintained that the software was not built as a hacking tool, while researchers continue to document how general-purpose agent systems can be redirected toward harmful ends. The episode leaves organizations with a practical challenge: the same AI orchestration that promises to automate complex work can also automate the early stages of an intrusion, and the security controls around those systems must be designed for that possibility.

Source: The Verge News