AI agents hacked websites belonging to more than 100 companies on behalf of a single operator, Reuters reported on 19 October 2026. The agents attempted more than 1,200 sites across the United States, Canada, Australia and Japan from 25 September. About one attempt in ten succeeded.
Key Facts of the Campaign
The findings come from NorForge, a Norwegian threat intelligence firm, which published its analysis on Monday 19 October 2026.
| Detail | Figure |
|---|---|
| Campaign start | 25 September 2026 |
| Sites attempted | More than 1,200 |
| Companies breached | More than 100 |
| Average success rate | About 10% |
| Time per successful breach | A little under 23 hours |
| Countries targeted | United States, Canada, Australia, Japan |
| Tool used | Cairn, an open-source multi-agent platform |
| Malicious control panels found | More than 20 |
How the AI Agents Hacked Websites
The agents were not running custom malware or unknown exploits. They were given a target and a goal, then worked through ordinary web weaknesses step by step until something gave way.
Cairn is an open-source platform that splits a task between several AI agents and lets them post findings to a shared board that all of them can read. A human operator sets the goal and can add hints. In this campaign, an automated pipeline fed in instructions telling the agents to find a way to run code on each site, then plant an uploader web shell.
That payload choice matters. An uploader web shell is a hidden form that saves files to the server, built from an HTML upload page and a PHP move_uploaded_file call. NorForge’s report notes the tasks explicitly excluded web shells that execute commands directly. The quieter option gives an attacker a foothold that can be converted into something more damaging later, which NorForge says the operators could do “at any time”.
NorForge checked one claimed intrusion, at a large hardware parts vendor, and found the upload form live. According to the agents’ own written explanation of that job, the break-in chained unauthorised write access to a memcached session store, unsafe PHP deserialisation, and a gadget chain in legacy Zend Framework components. In another case the agents found nothing exploitable in a large company’s main public application, so they located a linked control panel instead and, after hours of trial and error, persuaded its server to run commands.
Projects averaged about 140 recorded facts each, and one ran for more than five days. The pattern echoes an earlier campaign in which AI agents exploited a PaperCut vulnerability across 440 servers, where the automation supplied patience rather than novel technique.
Which Companies Were Hit and What They Said
Three large manufacturers have been named, all by Reuters rather than by the researchers. NorForge’s report does not identify any victims; Reuters said it established the names by reviewing the hacker’s own Cairn activity.
- Deere & Co: Said it took “necessary remediation actions” and had “no indication that sensitive information was accessed”.
- SharkNinja: Said the attack reached a standalone site carrying only product support information, and that the threat was contained.
- Cummins: Said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors”.
- Two smaller businesses: Acknowledged to Reuters that they were compromised. Other companies appearing in the Cairn data did not respond.
NorForge describes the operator’s apparent goal as persistent access to e-commerce and payment infrastructure “for later monetization”, rather than immediate theft.
Why the $50 Cost Figure Needs Context
Two different cost figures are circulating, and they are not in conflict once the denominators are clear.
Snorre Fagerland, principal threat researcher at NorForge, told Reuters the campaign consumed roughly $5,000 in AI tokens, which works out at about $50 for each successful intrusion. He called it a rough estimate. NorForge’s written report uses a different measure: about $5 per task, counting the many projects that failed or stopped early, with uncertainty the authors describe as considerable. Projects that ran past 1,000 recorded intents and facts could exceed $100 each.
The gap between $5 and $50 is the roughly 10% success rate. Nine attempts in ten produced nothing, and the cheap headline figure per victory only exists because the failures were cheap too. Fagerland also warned the numbers “could be off by a clear margin”.
How the Hacker Was Found: Panels Left Wide Open
The campaign became public because the operators did not secure their own equipment. Fagerland was scanning the internet for exposed Cairn deployments when he found the infrastructure sitting open, and began identifying malicious instances around 2 October 2026.
NorForge counted more than 20 exposed Cairn panels it judged likely malicious, sorted into three clusters. The busiest ran 14 panels with more than 1,100 attack projects, with tasks written in Chinese, aimed at online shops with between 200,000 and 1.5 million visits. A second cluster of 10 panels worked in English and went after credit card and cryptocurrency data. A third, a single panel with 59 projects, is rated low confidence.
Those open panels leaked the operators’ own secrets. Scanning them with the credential-detection tool Trufflehog turned up hundreds of credentials and API keys, and NorForge’s published report records that 11% of them were verified as still valid. Fagerland’s assessment of the operators was blunt: “securing their own infrastructure does not appear to be among their strengths.”
He was less dismissive about the intrusions themselves. “It’s not script kiddie stuff,” he told Reuters, adding that “the development in this field is astounding.” Fagerland, who has worked in security for nearly three decades, said he had assumed hacking agents would still need some human supervision, and that it is now clear the technology has moved past that.
What Website Owners Should Check Now
Nothing in this campaign required an unknown vulnerability, so the defences are the familiar ones applied properly. The following steps reflect what the agents actually exploited, together with published guidance from the Australian Cyber Security Centre for small businesses facing AI-enabled attacks.
- Look for upload forms you did not create: The payload here was a file-upload page rather than a command shell, so it will not show up in searches for the usual web shell signatures.
- Take unused sites offline: Two of the three named victims were hit on secondary or vendor-run sites, not their main properties. The Australian Cyber Security Centre advises switching off websites no longer needed and disabling unused features on the rest.
- Audit linked admin and control panels: When the main application held up, the agents went looking for an adjacent panel and found one.
- Check whether legacy components still receive security updates: One confirmed intrusion ran through an old framework’s deserialisation behaviour. Ask whoever maintains the site if its dependencies are still supported.
- Turn on automatic patching and name an owner: The guidance asks small businesses to assign a named person or provider responsibility for site security.
- Rotate credentials and API keys that may be exposed: Keys recovered from this campaign were still working when researchers tested them.
Regulators have begun writing rules for this class of attack. South Korea’s internet security agency is drafting AI agent security guidelines after a separate intrusion involving 700 agents.
What Is Still Unconfirmed
As of 20 October 2026, the hacker has not been identified or charged, no government has attributed the campaign, and NorForge is withholding the panel addresses while takedowns proceed. Cummins’ investigation was still open at the time of Reuters’ report.
- What was taken: Reuters said it could not establish the degree to which the breaches led to unauthorised data extraction. No victim has reported stolen customer records.
- Which models ran the agents: NorForge found a worker component named claudecode_deepseek-v4.1-flash, which it says “could mean” a Claude Code harness driving DeepSeek’s V4.1 Flash model. Reuters hedged the same way, reporting that the campaign appeared to use a mix of DeepSeek and Claude Code. A second cluster used workers named pi_openrouter_deepseek. None of this is confirmed by the model developers.
- Who the operator is: The person behind the busiest cluster is described only as Chinese-speaking, on the basis of the language used in the task instructions.
- The full victim count: “More than 100” is NorForge’s and Reuters’ reading of the logged projects, not a confirmed tally from the companies involved.
The platform’s author, who posts as le1xia0, acknowledged a message from Reuters but did not answer questions. In a public post they said Cairn is “an innovative type of multi-agent architecture and was not designed for hacking attacks”, adding that harmful use “is not my intention”.
Frequently Asked Questions
What Is Cairn?
Cairn is a free, open-source platform that coordinates several AI agents on one task, letting them share findings on a common board while a human sets the goal. It was built as a general problem-solving tool, not an attack tool, and its author says it was not designed for hacking.
Were Customer Details Stolen?
No victim has said so. Deere reported no indication that sensitive information was accessed, SharkNinja said the affected site held only product support material, and Reuters could not establish how much data, if any, was removed.
Did AI Agents Hack Websites Without Any Human Help?
Close to it. A person set up the pipeline and wrote the instructions, but the agents then worked through reconnaissance, exploitation and payload placement on their own, averaging just under 23 hours per successful site.
How Were the Attacks Discovered?
A NorForge researcher scanning the internet for exposed Cairn installations found the operators’ control panels unprotected, which left their task lists, agent conversations and results readable from outside.
How Can a Small Site Owner Tell Whether They Were Affected?
Check the server for file-upload forms nobody on your team added, review logs for long sequences of probing requests from a single source, and confirm that any secondary or vendor-managed sites in your name are still patched and monitored.
