🔍 Read the full analysis: The Cost Of A Break-In In The Age Of AI Agents on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A Reuters investigation, drawing on attacker records and security research, linked an AI-agent campaign to break-ins at websites of more than 100 companies. The operator’s identity, any data taken and the full cost of the campaign remain unconfirmed; a researcher estimated about $5,000 in AI costs.
A Chinese-speaking operator used software agents running on the open-source Cairn platform to probe online shops from September 25, with Reuters reporting break-ins at websites of more than 100 companies. The operation shows how one operator can coordinate prolonged, automated intrusion attempts, though the amount of data accessed or taken is not known.
By mid-October, the agents had tried more than 1,200 websites in the United States, Canada, Australia and Japan, according to records Reuters reviewed from the attackers’ Cairn control panels. Reuters identified affected companies including Deere, SharkNinja and Cummins. The NorForge security report, published October 19, described several clusters of activity but did not name victims; Reuters said it independently reviewed the activity and contacted companies.
NorForge researcher Snorre Fagerland found exposed Cairn dashboards while searching for internet-accessible control panels. The firm linked more than 20 panels to likely malicious activity. In the largest cluster, which NorForge labels AIA0001, the firm counted more than 1,100 attack projects across 14 panels. That is a count of projects in the observed panels, not a confirmed total for every campaign or victim.
NorForge measured successful projects in that cluster as taking a little under 23 hours from start to goal. Fagerland estimated the campaign’s AI costs at roughly $5,000, or about $50 per successful intrusion, but the report stressed that the estimate carries considerable uncertainty. These figures are estimates, not audited costs or a measure of the financial damage to victims.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Lower Costs, Longer Attack Windows
The reported operation matters because it suggests attackers can delegate repetitive probing to a group of agents and let activity continue with limited hands-on direction. NorForge’s estimate of roughly $50 in AI costs per successful intrusion is uncertain, but it points to a potential shift: attackers may be able to test more targets and spend longer on each attempt without adding a large human workforce.
That can put pressure on security teams even when an intrusion does not result in confirmed data theft. Automated attempts may generate a large volume of alerts, while less prominent web properties—such as support pages or vendor-operated sites—can provide routes into a company’s wider systems. The available reporting does not establish that any of these sites provided such access in this campaign; it does show why firms need to track and secure websites operated by third parties as well as their main platforms.
The incident also raises practical questions about how organizations identify automated activity and distinguish authorized agents from malicious ones. Cairn is a general-purpose agent platform, not a dedicated hacking product. The security concern described here comes from how the operator used it, not from evidence that the software itself was built for intrusion.
Products Worth Considering
Apple MacBook Pro 16-inch (2021) – M1 Pro Chip, 10-Core CPU, 16-Core GPU, 16GB RAM, 1TB SSD, Space Gray
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro 14‑inch (2021) with M1 Pro, 16 GB RAM, 512 GB SSD – Space Gray
As an affiliate, we earn on qualifying purchases.
How Researchers Traced Cairn Activity
The investigation developed after a separate report from Gambit Security in September. Gambit said it recovered a criminal staging server containing three AI agent systems—Hermes, Strix and Cairn—and documented a separate campaign that compromised at least 27 companies. Gambit reported that at least 600,000 card records were taken from two of those companies. That earlier campaign is distinct from the activity Reuters and NorForge examined; those figures should not be attributed to the later Cairn operation.
NorForge searched for exposed web dashboards used to manage Cairn agents. The firm said most dashboards require authorization, but it found some without a password and began identifying panels associated with malicious activity around October 2. New panels continued to appear. NorForge grouped the activity into three clusters and released its report on October 19, the same day Reuters published its investigation.
Cairn coordinates agents through shared information about what they have found and what they plan to do next. An operator can provide instructions or hints, while agents continue working through steps toward a goal. NorForge describes Cairn as a general problem-solving engine. Its author, known as le1xia0, told Reuters the platform was not designed for hacking and that harmful use was not their intention.
““It is a state-based problem solving engine, moving step by step in the general direction of a defined solution.””
— NorForge report
Data Access and Attribution Remain Unclear
Reuters could not establish how much data, if any, was taken in the campaign. Deere said it had no indication sensitive information was accessed. SharkNinja told Reuters that a standalone product-support site was hit and that the threat had been contained. Cummins said it was investigating a potential attack on a third-party vendor’s website. These statements describe different company responses and do not establish the full scope of access across all affected organizations.
The operator’s identity has not been publicly established. NorForge characterized the actor as Chinese-speaking; that description does not confirm the person’s nationality, location or identity. No arrest or charge was reported in the source material. The number of companies Reuters identified is based on its review of attacker records and does not by itself establish what systems were reached or what information was exposed at each company.
The estimated AI spending is also uncertain. NorForge called the cost estimate’s uncertainty considerable, and the reporting does not provide a verified accounting of model usage, infrastructure costs or losses suffered by victims.
Company Reviews and Further Findings
The immediate next step is for affected companies to establish what systems the agents reached, whether access persisted and whether any information was viewed or copied. Deere, SharkNinja and Cummins have described remediation, containment or an ongoing investigation, but the reporting does not give a shared timeline for completing those reviews or disclose a final accounting of impact.
Security researchers may continue monitoring exposed Cairn panels and documenting related activity. Further evidence could clarify whether the campaign’s recorded projects corresponded to successful access at individual companies and whether any access was later used for theft or resale. Until companies or investigators release more details, the extent of data exposure and downstream harm remains unresolved.
Key Questions
What happened in the reported campaign?
Reuters reported that an operator used agents on the Cairn platform to probe more than 1,200 websites and break into websites associated with over 100 companies. The campaign targeted online shops in several countries.
Who was behind the activity?
The operator has not been publicly identified. NorForge described the actor as Chinese-speaking, but that does not confirm nationality or location. The source material reports no arrest or charge.
Was customer or payment data stolen?
That has not been established. Reuters could not determine how much data, if any, was taken. Company statements describe investigations and remediation, but do not provide a complete account of data access across the campaign.
How much did the campaign cost to run?
NorForge researcher Snorre Fagerland estimated roughly $5,000 in AI costs for the campaign, or around $50 per successful intrusion. NorForge said the estimate has considerable uncertainty; it is not a verified total cost.
Was Cairn built as a hacking tool?
NorForge describes Cairn as a general-purpose, state-based problem-solving engine. Its author, known as le1xia0, told Reuters it was not designed for hacking and said harmful use was not their intention.
Source: ThorstenMeyerAI.com
