What happened
NorForge's lead threat researcher Snorre Fagerland found that more than two dozen internet-exposed instances of Cairn, an open-source AI platform, were being used for malicious activity. The malicious activity began around October 2. Through these instances, a Chinese-speaking hacker used AI agents to attack the websites of more than 100 companies — including agricultural equipment maker Deere, appliance maker SharkNinja, and engine manufacturer Cummins. AI agents did nearly all of the hacker's work. Reuters reported the story in an exclusive on October 19, 2026.
The hacker began targeting e-commerce sites in the United States, Canada, Australia, and Japan on September 25. Reuters notes that the hacker spoke Chinese — the instructions he gave the agents were written in Chinese. The campaign ran entirely through exposed instances: the hacker located unprotected Cairn instances online and issued them instructions. Over the course of the campaign, he probed more than 1,200 sites, with an average of 23 hours of automated reconnaissance behind each successful breach. The researcher estimates the instructions the hacker gave the agents ran to fewer than 100 Chinese characters.
How the attack worked
The hacker issued brief instructions — a Chinese text of fewer than 100 characters — and AI agents did nearly everything else on their own. The agents hunted for website vulnerabilities, tested entry points, and automatically repeated break-in attempts. The agents managed almost the entire attack chain themselves — from vulnerability hunting to repeated intrusion attempts. Typically, before a successful breach, the agents scouted the target for an average of 23 hours.
Cairn is an open-source multi-agent problem-solving platform built by a developer known as le1xia0. It was designed for legitimate purposes, but misconfigured instances left exposed to the internet fell into the hacker's hands. Fagerland found more than twenty such exposed instances. Tokens were split between China's DeepSeek model and Anthropic's Claude Code tool — the researcher confirmed this specific two-source mix was used. The researcher estimates the entire campaign cost roughly $5,000 in tokens from China's DeepSeek model and Anthropic's Claude Code tool — about $50 per successful breach. The Verge independently confirmed NorForge's findings and reported that more than 20 exposed Cairn instances were likely used maliciously.
Responses from the affected companies
Reuters obtained comment from three major companies. Deere told Reuters it had taken the necessary remediation steps and found no evidence that confidential data had been accessed. Deere is a major agricultural equipment corporation; no data theft has been confirmed in the attacks on its sites.
SharkNinja, an appliance maker, said the attack targeted its separate product-support portal and that the threat had been contained. According to the company, its core systems were unaffected. Cummins said it was investigating reports of a cyberattack on a third-party supplier's website — meaning the attack may have been aimed at a partner's site rather than Cummins' own infrastructure. All three companies told Reuters they had the situation under control or were investigating — none confirmed a large-scale data leak.
Response from Cairn's creator
"Cairn is an innovative multi-agent architecture; it was not designed for hacking attacks, and its use for malicious purposes was not my intention," le1xia0, the developer known as the founder of the Cairn project, told Reuters.
The campaign in numbers
The campaign was observed from late September to early October: the hacker targeted more than 1,200 sites, and over 100 were successfully breached — roughly one attempt in ten succeeded. The hacker's own contribution was limited to a brief instruction of fewer than 100 characters; AI agents did the rest. The estimated campaign cost was $5,000, or about $50 per successful breach. According to Fagerland, the AI agents watched and probed targets for hours before each successful breach. This case highlights the real danger of internet-exposed services — and as the number of corporate and commercial websites in Uzbekistan keeps growing, regularly checking open ports and unprotected interfaces remains a pressing task.
More details in the Reuters exclusive and The Verge's commentary.
