Norforge, an AI‑focused security company, discovered that a hacker used an “army” of AI agents to infiltrate more than 100 websites. The tool they abused is called Cairn, an open‑source platform that lets users define a start and end point for AI agents and then tracks their progress. While Cairn is marketed as a general‑purpose problem‑solving engine, the researcher says the same functionality can be repurposed for cyberattacks.
Who was hit and how long it took
The compromised sites included well‑known firms such as John Deere, SharkNinja and Cummins, according to Reuters. The attacker’s preferred intrusion tactics were described in fewer than 100 Chinese characters, and successful breaches averaged about 23 hours from start to finish. Norforge identified more than 20 Cairn instances that appear to be malicious, with the “most active” instance responsible for the bulk of the 100‑plus breaches.
Company responses
John Deere said there is “no indication that sensitive information was accessed.” Cummins said it is “investigating the report of a potential cyber‑attack on a website operated by one of our third‑party vendors.” SharkNinja confirmed that a standalone support site was compromised but has since contained the threat.
Why it matters
For everyday internet users, the breach shows that AI tools can be turned into automated hacking assistants, potentially widening the pool of attackers. Companies may need to audit open‑source AI platforms they use and monitor for unusual AI‑driven activity. It remains unclear how many other sites were affected or whether any data was stolen.
