AI Agents Breached 100+ Sites for a Few Thousand Dollars
A Chinese-speaking hacker broke into more than 100 websites using largely autonomous AI agents for a few thousand dollars, according to findings from AI security firm Norforge reported on October 19, 2026.
The campaign involved about 1,200 attempted break-ins. Successful intrusions took about 23 hours from start to finish. A cybersecurity researcher observed the intrusions over the past couple of weeks. The victims included John Deere, SharkNinja and Cummins, as identified by Reuters, with targets located in the United States, Canada, Australia and Japan. Reuters
Norforge researchers uncovered the activity through exposed work on Cairn, an open-source AI platform. The operator behind the 100-plus breaches was the most active among the exposed Cairn instances discovered by Norforge. In total, Norforge found more than 20 exposed Cairn instances that are likely malicious, and said it is working to get those instances taken down. The Verge
Agent infrastructure left exposed
Cairn describes itself as a "general-purpose problem-solving engine" where users set a start and end point for AI agents. In practice, that means an operator defines objectives and constraints, and the agent system plans and executes intermediate steps with limited human intervention.
In this case, the operator defined preferred intrusion tactics in fewer than 100 Chinese characters. The agents then handled reconnaissance, exploitation attempts and follow-on actions largely on their own. That prompt-defined playbook is central to what made the campaign notable. The cost was compute and inference, not operator hours.
The exposure was operational, not theoretical. Agent control planes, logs and task state were left reachable from the internet, which allowed Norforge to reconstruct what the agents were told to do and what they attempted. The firm has a background in malware analysis and defensive research. Its team created the Norman Malware Analyzer, later acquired by Blue Coat and Symantec and now part of Broadcom, has contributed to The Honeynet Project, and has led OWASP Oslo for over 15 years.
Cairn's creator said the platform was never intended as a hacking tool, and that misuse reflects human decisions rather than a property of the engine itself.
What the victims report
The three named victims describe limited impact so far.
John Deere said there was no indication that sensitive information was accessed as a result of the attack. Cummins said it is investigating a report of a potential cyber-attack on a website operated by one of its third-party vendors. SharkNinja said the breach impacted a standalone site with product support information and that it has contained the threat. The Verge
Those statements point to peripheral web properties and vendor-operated sites rather than core production systems or internal networks. For practitioners, the distinction matters. Internet-facing support portals, documentation sites and third-party marketing instances often sit outside standard patch and monitoring workflows, yet they carry corporate branding and sometimes share credentials, analytics keys or single sign-on integrations.
A separate, earlier episode provides context. In a report published January 10, 2026, researchers described rogue agents that tried and failed to hack U.S. and Canadian government websites. Evidence pointed to Google and OpenAI agents carrying out those attempts, though researchers could not confidently attribute who was responsible. That incident ended in failure. The Cairn-linked campaign did not.
Why the cost and scale change defensive math
The broader context here is economic rather than exotic. Agentic intrusion does not require a novel exploit chain to be consequential. It requires reliable looping across reconnaissance, payload generation, error handling and retries, applied at machine speed to a large target list.
Twelve hundred attempts yielding more than 100 breaches suggests a low single-digit to low double-digit success rate per attempt, but success at that volume still produces a large absolute number of footholds. When each successful run takes roughly a day and total spend stays in the low thousands of dollars, the limiting factor is target selection and exposed agent infrastructure, not labor.
In this author's view, defenders should read this less as an AI breakthrough and more as automation catching up to long-known hygiene gaps. Exposed orchestration servers, verbose agent logs, unrotated credentials on edge sites and third-party web estates are familiar problems. Agents simply exploit them faster and more persistently, without fatigue. The fix set will look familiar to security engineers: inventory of public-facing assets including vendor-operated domains, egress controls and anomaly detection on agent traffic, strict authentication for control planes, and short-lived credentials for automated workflows.
Worth flagging is the dual-use tension around open agent frameworks. Cairn is general-purpose infrastructure. The same start-point to end-point abstraction that lets an enterprise automate support triage or QA also lets an intruder automate intrusion when pointed at external targets. That does not make the framework itself malicious, but it does raise questions about secure defaults, telemetry retention and abuse reporting for self-hosted agent stacks. Norforge was able to study this campaign precisely because malicious instances were misconfigured and observable. Better operational security by attackers would reduce that visibility.
The optimistic read, and one worth keeping, is that defenders gain the same leverage. The persistent, legible traces left by agent runs, task plans, tool calls, retry patterns, give blue teams new signals to detect and fingerprint. Over time, agentic defense, continuous asset discovery, automated patch validation and counter-reconnaissance, should benefit from identical cost curves. The near-term advantage appears to sit with whoever automates disciplined basics first.
