One Hacker, a Swarm of AI Agents, $50 a Break-In: How Cairn Reached Deere, SharkNinja and 100+ Sites (AI Trends, 19 October 2026)

Q: Which AI models were used in the attacks?

The main cluster's tasks ran on a worker named claudecode_deepseek-v4.1-flash, which NorForge says could mean Anthropic's Claude Code agent harness running DeepSeek's V4.1 Flash model. Reuters reported that the campaign appeared to mix DeepSeek and Claude Code.

What’s trending in AI on 19 October 2026: A security researcher scanning the internet for copies of an open-source AI agent platform called Cairn found something he did not expect: attackers had left their control panels exposed, and inside them he could read the agents’ work logs. The busiest operator, a Chinese-speaking hacker working largely alone, had pointed autonomous agents at more than 1,200 websites since 25 September and, according to Reuters, broken into more than 100 of them. Reuters traced activity to sites linked to Deere, SharkNinja and Cummins. The estimated cost was about $5,000 in AI tokens, or roughly $50 for each successful break-in. Below: what NorForge found, how the agents got in, why the price matters more than the headline names, how it compares with last month’s AI-driven card-skimming spree, and a checklist split by who in your business should act.

Key takeaways

Agents did the grind. The operator gave short instructions; agents then probed each target for hours with little further input. Successful intrusions took a little under 23 hours on average.
The price collapsed. About $50 per successful hack, or around $5 per attempted task by NorForge’s count. That makes small and mid-size online shops worth attacking at scale.
Online stores were the target. The main campaign hit e-commerce sites in the US, Canada, Japan and Australia, planting upload web shells for lasting access to shop and payment systems.
Big names, limited confirmed damage. Deere, SharkNinja and Cummins say the affected sites were contained, standalone or vendor-run. Reuters could not establish whether any data was taken.
This is a pattern, not a one-off. In September, Gambit Security tied the same Cairn tool to a spree that took more than 600,000 card records from two companies.

The story is less about one attacker than about how cheap patient, automated intrusion has become.

1. What NorForge found

Cairn is an open-source “AI problem-solving” platform. You give it a target and a goal, and a team of agents works toward it step by step, posting findings to a shared board that every agent can read. Operators can drop in hints. Its author, who posts as le1xia0, has said on X that it is a multi-agent architecture not built for hacking and that harmful use is not the intention. It is, however, popular with people who want to break into things, and some of them did not lock the door behind them.

Snorre Fagerland, principal threat researcher at NorForge, went looking for internet-facing Cairn deployments with ordinary scanning tools. According to The Next Web’s summary of the Reuters report and NorForge’s own write-up, he began finding them around 2 October. NorForge judged more than 20 exposed panels likely malicious and grouped them into three clusters:

A Chinese-language cluster (high confidence, the busiest): more than 1,100 attack projects across 14 panels, aimed mostly at online shops in the US, Canada, Japan and Australia.
An English-language cluster: 10 panels where agents were told to steal credit cards and cryptocurrency.
A third cluster: one panel with 59 projects, malicious only at low confidence.

Reuters reports that by late last week the main operator’s agents had tried more than 1,200 sites and got into more than 100. NorForge put the average success rate across the tools it observed at roughly 10%, while cautioning that the clusters had different goals and should not be compared directly. NorForge published its report on Monday, 19 October, and says it is working with Reuters to warn victims and with hosting firms to get the panels taken down. Fagerland’s verdict on the work he saw: “It’s not script kiddie stuff.”

A 10% hit rate sounds low until each attempt costs a few dollars and nobody has to stay awake for it.

2. How the agents got in

The striking detail is how little the human did. Startup Fortune, summarising the Reuters account, says the operator’s instructions ran to fewer than 100 Chinese characters: a short list of intrusion tactics. After that, an automated pipeline handed each target to the agents with a simple brief: find a way to run code on the site, then plant an “uploader” web shell. That is a small form that saves files to the server rather than one that runs commands directly, a quieter foothold that can be used later to add more tools. NorForge reads the goal as lasting access to shop and payment systems, and it confirmed one claimed break-in, at a large hardware parts vendor, by finding the web shell still live.

The agents were also persistent in a way human attackers often are not. In one case they found no weakness in a large company’s public web application, so they went sideways: they searched public records for related servers, found a linked control panel, and spent hours of trial and error on a subtle data-handling flaw until they could make its server run commands. Successful intrusions took a little under 23 hours on average. No person would grind that long on a $50 target. An agent does not mind.

Which AI did the work? All tasks in the main cluster appear to have run on a worker named “claudecode_deepseek-v4.1-flash”. NorForge’s reading is that this could mean Anthropic’s Claude Code agent harness driving DeepSeek’s low-cost V4.1 Flash model, rather than Anthropic’s own models doing the reasoning. Reuters reports that the campaign appeared to mix DeepSeek and Claude Code. Neither company had commented in the coverage we read. The broader point stands either way: the components are downloadable, cheap and interchangeable, which is the same lesson we drew from open-weight models gaining elite hacking skills and from CLOSEDQUORUM, the implant that asks AI models what to do next.

The pivot in step 3 is why “our main site is patched” is not the same as “we are safe”.

3. The $50 break-in: why the price is the real news

Fagerland estimated that the main operator spent about $5,000 on tokens, which works out to roughly $50 per successful hack. He called it a rough figure, and NorForge’s report frames it differently, at about $5 per task once failed and abandoned attempts are counted, with considerable uncertainty. Startup Fortune notes his comparison: the cost per victim was less than an hour of a junior penetration tester’s time.

That is the shift. Until recently, the rough rule for a small business was that it was protected partly by being boring: a skilled attacker’s time was too expensive to spend on a mid-size online shop when bigger targets existed. When the attacker’s time is replaced by agent hours that cost a few dollars, that rule stops working. Martin Cid Magazine makes the same argument: low per-target cost makes small shops, which still handle addresses and card numbers, worth attacking. It echoes what Microsoft warned about in its 2026 Digital Defense Report, and what we covered in our earlier look at AI-powered threats to small and mid-size businesses.

Every estimate sits below what a business pays for an hour of professional security testing.

4. Not the first Cairn campaign: September’s card-skimming spree

If this sounds familiar, it should. On 22 September, Israeli firm Gambit Security described an attacker who used three open-source agent frameworks, Cairn among them, to break into at least 27 companies, as The Next Web reported at the time. That operator’s agents planted card skimmers and took more than 600,000 card records from two of the victims. The two campaigns differ in scale, tooling and goal, but together they show a repeatable model rather than a lucky one-off.

	Gambit Security findings (September)	NorForge findings (October)
Reported	22 September 2026	19 October 2026
Agent tools	Strix (scanning), Cairn (exploitation), Hermes (orchestration)	Cairn, on a worker labelled for Claude Code and DeepSeek V4.1 Flash
Models named	Z.ai GLM 5.2, DeepSeek V4 Pro and V4.1 Flash, Claude Opus 4.6	Likely DeepSeek V4.1 Flash via a Claude Code harness
Scale	105 attack projects in 10–15 September; at least 27 companies breached	1,200+ sites tried; 100+ breached, per Reuters
Goal seen	Card skimming; 600,000+ card records from two firms	Upload web shells for lasting access to shop and payment systems
Attacker cost	$7,005.71 on one account over four weeks; total estimated at $12,000–$18,000	About $5,000 in tokens (rough)
Collateral damage	Clean-up routines wiped 180 database tables, including backups, at one retailer	Not established; Reuters could not confirm data taken

Sources: The Next Web on Gambit Security (28 Sep 2026) and on NorForge (19 Oct 2026). Figures are the researchers’ own estimates.

Two details from Gambit’s case are worth carrying into your own planning. The skimmers were hidden in places routine reviews skip: inside JavaScript libraries such as jQuery, in Google tags and in Kubernetes containers. At one wine retailer, a scheduled job reinstalled the skimmer every two minutes, so redeploying the site did not remove it. And the agents’ clean-up behaviour destroyed data: 180 database tables at a bicycle retailer, backups included. An AI intruder does not need to be malicious about your data to wreck it.

5. The attackers left their own doors open

There is an irony at the centre of this story. The only reason we can see inside the campaign is that its operators exposed their dashboards to the internet, the same basic mistake their agents were hunting for. The panels also held hundreds of credentials, API keys and other secrets. NorForge ran them through the open-source scanner Trufflehog, which verified 11% as still valid. Some legitimate security testing firms had made the same error and left client work visible.

Two lessons follow. First, the visibility was luck. As Martin Cid Magazine points out, the next operator can simply keep the dashboard private, and takedowns remove the panels but not the people or the agents. Second, if your business hires a pentest firm or runs its own agent-based testing, ask where the tooling is hosted and who can reach it. Exposed AI infrastructure has been a recurring theme here, from LLM botnets and unpatched AI servers to CERT-In’s alert on leaked keys and test agents, and this morning’s OpenCode Console breach.

6. What the named companies said

NorForge’s report names no victims. Reuters identified three by reviewing the attacker’s Cairn activity, and each response points to the edges of the business rather than the core:

Deere said it took the necessary remediation steps and has no indication that sensitive information was accessed.
SharkNinja said the attack hit a standalone site holding product support information and that the threat was contained.
Cummins said it was investigating a potential attack on a website run by a third-party vendor.

Martin Cid Magazine adds that two smaller businesses confirmed breaches and the other companies did not respond. Reuters could not establish how much data, if any, was taken. The pattern in those answers is the useful part: support microsites, vendor-run pages and forgotten subdomains are exactly where a patient agent finds a way in, because they carry the brand but often sit outside the main security programme.

7. Meanwhile, the defender job market is reshaping

A separate report published this weekend adds context. CyberSN’s Cybersecurity Jobs Report, covered by SecurityWeek, counted 235,786 US cybersecurity job postings from January to September 2026, down 26.4% from 320,210 in the same months of 2025. Penetration tester postings fell 45.9%. Over the same period, postings for AI Security Engineers rose 268.3%. CyberSN describes what changed, not why, so we would not read too much into it. But it sits awkwardly next to an attack model whose cost per victim is now below an hour of a junior tester’s time. If AI is doing more of the probing on both sides, businesses still need someone who understands what their own agents and scanners are finding.

Each entry point has a different owner, which is why the checklist below is split by role.

8. The agent-proof checklist, by owner

Our last few guides have been time-ordered runbooks. This one is split by role, because the weak points above belong to different people. Hand each block to its owner and ask for a yes or no on every line by Friday. It is general guidance, not legal advice.

IT and hosting

☐ Every admin, control and hosting panel is behind a VPN, single sign-on or an IP allow-list, not just a password.
☐ We have a current list of every domain and subdomain we own, including old campaign and support sites, and each has a named owner.
☐ Our web application firewall or bot management alerts on long, patient probing from one source, not only on high-volume bursts.
☐ Web servers cannot write to directories the site serves as code, so an uploaded file cannot become a web shell.
☐ We search for unexpected upload forms and newly added files in web roots at least weekly.

E-commerce and web team

☐ Checkout pages load only approved scripts, enforced by a Content Security Policy, and we monitor for script changes on payment pages.
☐ Third-party libraries and tag-manager tags are pinned, reviewed and checked against known-good versions.
☐ Scheduled jobs (cron) on web servers are reviewed, so nothing can quietly reinstall a skimmer after a redeploy.
☐ Payment card entry runs through a hosted payment page or iframe from our processor where possible.

Marketing and vendor managers

☐ Every agency, microsite and vendor-run page that carries our brand is in the inventory, with a contract clause covering patching and breach notice.
☐ Expired campaigns and product-support sites are switched off rather than left running.
☐ We know which vendors hold customer data collected under our name.

Operations and leadership

☐ Backups are offline or immutable and cannot be reached or deleted from a web server.
☐ We have tested a restore in the last quarter.
☐ If we use AI agents or outside testers for security, their dashboards and logs are private, and their stored secrets are rotated.
☐ Someone owns the question “what would a patient attacker try on our smallest website?” and has budget to answer it.

9. The bottom line

The names in this story are big, but the confirmed damage so far is small and sits on side sites. The real news is the unit cost. A largely solo operator with a downloadable framework and cheap models kept agents working on more than a thousand websites for weeks, and the bill for each success was roughly what a business spends on a team lunch. That changes who gets attacked. Treat every site that carries your brand as a target, lock down anything with “admin” in its name, watch your checkout scripts, and keep backups out of reach. The agents will keep trying. Make sure there is nothing easy for them to find.

Frequently asked questions

What is Cairn?

Cairn is an open-source multi-agent platform that takes a target and a goal and has AI agents work toward it step by step, sharing findings on a common board. Its author says it was not designed for hacking, but researchers at NorForge and Gambit Security have found it used in criminal campaigns in 2026.

How many companies did the AI-agent hacker breach?

According to Reuters, the main operator’s agents tried more than 1,200 websites from 25 September and broke into more than 100. NorForge estimated an average success rate of about 10% across the tools it observed.

Was customer data stolen from Deere, SharkNinja or Cummins?

Not as far as has been established. Deere said it saw no sign that sensitive information was accessed, SharkNinja said a standalone support site was hit and the threat was contained, and Cummins said it was investigating a site run by a third-party vendor. Reuters could not determine whether any data was taken.

Which AI models were used in the attacks?

The main cluster’s tasks ran on a worker named “claudecode_deepseek-v4.1-flash”, which NorForge says could mean Anthropic’s Claude Code agent harness running DeepSeek’s V4.1 Flash model. Reuters reported that the campaign appeared to mix DeepSeek and Claude Code.

How much does an AI-driven break-in cost an attacker?

NorForge’s researcher estimated about $5,000 in tokens for the main campaign, or roughly $50 per successful hack, and about $5 per task when failed attempts are counted. In September, Gambit Security put the average cost of a completed scan in a separate campaign at $25.46.

What should a small online shop do first?

Put admin and hosting panels behind a VPN, single sign-on or IP allow-list, inventory and retire forgotten subdomains and support sites, lock down which scripts can run on checkout pages, stop web servers from writing executable files, and keep backups offline where a compromised server cannot delete them.