# Hackers used AI agents to breach over 100 company websites

> Security firm Norforge says an attacker leveraged the open‑source Cairn platform to break into sites including John Deere, SharkNinja and Cummins.

Oossa · 2026-10-19 · https://oossa.com/en/hackers-used-ai-agents-to-breach-over-100-company-websites

Norforge, an AI‑focused security company, discovered that a hacker used an “army” of AI agents to infiltrate more than 100 websites. The tool they abused is called Cairn, an open‑source platform that lets users define a start and end point for AI agents and then tracks their progress. While Cairn is marketed as a general‑purpose problem‑solving engine, the researcher says the same functionality can be repurposed for cyberattacks.

## Who was hit and how long it took

The compromised sites included well‑known firms such as John Deere, SharkNinja and Cummins, according to Reuters. The attacker’s preferred intrusion tactics were described in fewer than 100 Chinese characters, and successful breaches averaged about 23 hours from start to finish. Norforge identified more than 20 Cairn instances that appear to be malicious, with the “most active” instance responsible for the bulk of the 100‑plus breaches.

## Company responses

John Deere said there is “no indication that sensitive information was accessed.” Cummins said it is “investigating the report of a potential cyber‑attack on a website operated by one of our third‑party vendors.” SharkNinja confirmed that a standalone support site was compromised but has since contained the threat.

## The facts

- Norforge found the attacker used the open‑source Cairn platform to run AI agents against more than 100 websites.
- The victims included John Deere, SharkNinja and Cummins, among others in the US, Canada, Australia and Japan.
- Successful intrusions took about 23 hours on average, according to Reuters.
- Norforge identified over 20 Cairn instances they consider likely malicious.
- John Deere reported no sign of sensitive data being accessed.

## Why it matters

For everyday internet users, the breach shows that AI tools can be turned into automated hacking assistants, potentially widening the pool of attackers. Companies may need to audit open‑source AI platforms they use and monitor for unusual AI‑driven activity. It remains unclear how many other sites were affected or whether any data was stolen.

## Sources & references

1. [A hacker broke into John Deere and SharkNinja with an army of AI agents](https://www.theverge.com/ai-artificial-intelligence/1013643/ai-agents-hack-john-deere-shark-ninja-cummins) – The Verge, 2026-10-19
2. [A Chinese hacker used AI agents to break into more than 100 company websites](https://www.tomshardware.com/tech-industry/artificial-intelligence/a-chinese-hacker-used-ai-agents-to-break-into-more-than-100-company-websites-deere-and-sharkninja-among-websites-hit-by-open-source-ai-powered-problem-solving-platform-demo) – Tom's Hardware, 2026-10-19

Last updated: 2026-10-19