The Cairn Platform Used in Coordinated AI-Agent Attacks

A hacker used an army of AI agents to break into more than 100 websites, according to findings from AI security firm Norforge. Though Norforge did not name the targets, Reuters reported the victims included companies like John Deere, SharkNinja, and Cummins. The AI agents carried out the attacks with little involvement from the human hacker.

Cairn and How the Attacks Unfolded

Researchers at Norforge uncovered the attacks through exposed work on Cairn, an open-source AI platform that describes itself as a "general-purpose problem-solving engine." With Cairn, users set a start and end point for AI agents, which document their progress as they move forward with a task. However, as noted by Norforge, hackers can also use the tool to orchestrate cyberattacks using AI agents.

The hacker who broke into more than 100 sites was the "most active" among the exposed Cairn instances discovered by Norforge. According to Reuters, this attacker waged attacks on companies based in the US, Canada, Australia, and Japan. The attacker laid out "preferred intrusion tactics" using fewer than 100 Chinese characters, with successful breaches taking about 23 hours, according to Reuters. Overall, Norforge found more than 20 exposed Cairn instances that are "likely malicious."

Company Responses

Cummins spokesperson Melinda Koski said in a statement to The Verge that the company "is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." A John Deere spokesperson told Reuters that there's "no indication that sensitive information was accessed" as a result of the attack. SharkNinja said the breach impacted a standalone site with product support information, and that it has contained the threat.

John Deere and SharkNinja did not immediately respond to The Verge's request for comment.

Platform Creator's Statement

Cairn's creator, who goes by @le1xia0, said earlier this month that the platform "was never a 'hacking tool,'" adding that "misuse is a human decision, not a feature of the engine." Norforge says it's working to get the malicious Cairn instances taken down.

Security Implications for Development Teams

This incident highlights how AI agent frameworks can be repurposed when deployment environments lack adequate isolation. Platforms designed for general problem-solving can become attack vectors if exposed instances allow uncontrolled agent operation. The relatively low character count for intrusion tactics — fewer than 100 Chinese characters — suggests the attack patterns may be scriptable or automatable, raising questions about detection and rate-limiting strategies for agent-based systems.

For teams building or integrating AI agents, the case underscores the importance of sandboxing, outbound access controls, and monitoring for anomalous agent behavior. When agent platforms expose progress documentation or progress-tracking features, those same mechanisms can be observed and replicated by actors seeking to automate intrusion sequences.

Key Facts

  • More than 100 websites were targeted in the campaign
  • Victims included John Deere, SharkNinja, and Cummins
  • Attacks originated from exposed Cairn instances
  • The most active attacker used fewer than 100 Chinese characters for intrusion tactics
  • Successful breaches took about 23 hours
  • Norforge identified more than 20 exposed Cairn instances as "likely malicious"
  • Cummins is investigating a potential cyber-attack on a third-party vendor website
  • John Deere reported no indication of sensitive information access
  • SharkNinja contained the threat to a standalone product support site
  • Cairn's creator states misuse is a human decision, not a feature of the engine