🔍 Read the full analysis: What Happens To Hacking Costs When AI Agents Join In? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Chinese-speaking operator used Cairn, a free, open-source platform for coordinating AI agents, to target online shops from late September to mid-October 2026. Reuters, citing attacker records, reported attempted activity at more than 1,200 sites and break-ins at websites of more than 100 companies; NorForge estimated the campaign’s AI costs at about $5,000, but said the estimate carries considerable uncertainty.
An operator used a free, open-source AI agent platform to run a weeks-long campaign against online shops, with records reviewed by Reuters indicating attempted activity at more than 1,200 sites and break-ins at websites of more than 100 companies. The campaign, which began September 25, shows how one operator can automate prolonged probing; its actual financial cost and the amount of data accessed remain uncertain.
Security firm NorForge researcher Snorre Fagerland found exposed control panels for Cairn, software that coordinates AI agents, and monitored activity through some of them. NorForge identified more than 20 panels it linked to likely malicious use. Its report, published October 19, grouped the activity into three clusters. The largest, called AIA0001, wrote tasks in Chinese and had more than 1,100 attack projects across 14 panels, according to NorForge.
Reuters independently reviewed activity in the attacker’s Cairn records and reported that the agents had tried more than 1,200 sites by mid-October, targeting online shops in the United States, Canada, Australia and Japan. Reuters identified websites associated with companies including Deere, SharkNinja and Cummins. Those companies described different responses: Deere said it had taken remediation steps and had no indication sensitive information was accessed; SharkNinja said a standalone product-support site was affected and the threat was contained; Cummins said it was investigating a potential attack on a site operated by a third-party vendor.
NorForge measured successful projects as taking a little under 23 hours from start to goal. The firm estimated about $5,000 in AI costs for the campaign, or roughly $50 per successful hack, while warning that the estimate had “considerable” uncertainty. Reuters could not establish how much data, if any, was taken. The reporting identifies a Chinese-speaking operator, but does not establish the person’s identity or location.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Automation Lowers the Cost of Persistence
The reported campaign matters less as proof that AI agents can break into any particular system than as an example of how automation can change the economics of repeated attempts. An operator can delegate long-running, sequential probing across many targets instead of carrying out every step manually. NorForge’s cost figure is an estimate, not an audited accounting, but it points to the possibility that attackers can spend relatively little on persistence and scale.
That can shift pressure onto defenders. A large volume of automated activity may create more alerts and investigations, while online shops, support pages and sites run by outside vendors can provide pathways into organizations. In this case, the companies’ statements varied, and the available reporting does not establish that sensitive data was stolen from the named firms. The immediate issue for organizations is to review exposed web systems and third-party services without treating every attempted intrusion as a confirmed data breach.
The use of an agent platform also complicates questions of responsibility and oversight. Cairn is general-purpose software, and its author said it was not designed for hacking. The reported misuse does not, by itself, show that the platform’s developer directed or endorsed the campaign.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Researchers Found Cairn Panels
The reporting began with a separate investigation. In September 2026, Gambit Security described another agent-driven campaign after recovering a criminal staging server containing three tools for letting AI models act autonomously: Hermes, Strix and Cairn. That investigation reported at least 27 companies compromised and at least 600,000 card records taken from two of them. It is a separate campaign, not evidence that the same operator was behind both incidents.
After Gambit’s report, NorForge looked for internet-accessible dashboards used to manage Cairn. Fagerland found panels that lacked password protection, although NorForge said most panels it encountered required authorization. From around October 2, he identified roughly two dozen panels associated with malicious activity, according to Reuters. New panels continued to appear. NorForge published its findings on October 19, the same day Reuters published its investigation.
Cairn’s author, who uses the name le1xia0, described the software as a state-based problem-solving engine rather than a hacking tool. NorForge’s account describes agents sharing findings and planned next steps through a common state system, allowing tasks to continue with less direct input from an operator. That description helps explain how the activity could run for hours or days; it does not establish that every agent action was fully autonomous.
““a little under 23 hours””
— NorForge report
Data Access and Costs Remain Unclear
The available records do not settle what information, if any, was taken from the affected websites. Reuters said it could not establish the amount of data accessed. Deere reported no indication that sensitive information was accessed, SharkNinja said it contained the threat, and Cummins said it was investigating a potential attack involving a vendor-operated site. These statements do not establish a common outcome across the campaign.
The operator’s identity is also unknown. The reporting describes the person behind the largest cluster as Chinese-speaking, but does not identify them or establish who they worked for. NorForge’s estimate of about $5,000 in AI costs and roughly $50 per successful hack is a researcher estimate with considerable uncertainty; it should not be treated as a verified total or a general cost for AI-assisted intrusions.
Finally, the reports do not show whether the activity resulted in persistent access, later resale of access, or financial gain. NorForge said the apparent objective was to gain persistent access to e-commerce and payment infrastructure for possible later monetization. That is the firm’s interpretation of the campaign, not confirmed evidence of what happened after access was obtained.
Victim Reviews and Investigations Continue
The next developments will depend on what affected organizations and investigators can establish about the sites, access gained and possible data exposure. Cummins said it was investigating the potential attack on a third-party-operated website. The reporting does not give a public timetable for the company’s findings or describe a final accounting of affected sites.
Organizations named in the reporting may provide further information as their reviews progress. NorForge’s publication of the activity clusters gives security teams a basis for examining exposed Cairn control panels and related web services, while the company statements indicate that at least some incidents prompted remediation or containment. Whether investigators will identify the operator, establish the campaign’s full scope or confirm data theft remains open.
Key Questions
What happened in the reported AI-agent campaign?
An operator used Cairn, an open-source platform that coordinates AI agents, to target online shops. Reuters reported attempted activity at more than 1,200 sites and break-ins at websites of more than 100 companies, based on attacker records.
How much did the campaign cost?
NorForge estimated about $5,000 in AI costs, or roughly $50 per successful hack. The firm described the estimate as subject to considerable uncertainty; it is not a verified accounting of the campaign’s total costs.
Was sensitive customer data stolen?
That has not been established across the reported campaign. Reuters could not determine how much data, if any, was taken. Deere reported no indication that sensitive information was accessed, while the other company statements described their own investigations or response.
Who operated the agents?
The operator has not been identified. NorForge described the largest activity cluster as writing tasks in Chinese, and the reporting refers to a Chinese-speaking actor, but it does not establish the person’s identity or affiliation.
Source: ThorstenMeyerAI.com
