al-ice.ai

Fifty Dollars a Break-In, Twenty-Three Hours Each: The Cairn Agent Army Behind 100+ Intrusions

Agent & Supply Chain Security by al-ice.ai Editorial

Over the past couple of weeks, a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins — and did almost none of the work. That is the opening of Raphael Satter’s Reuters exclusive of 19 October 2026, built on a report from Snorre Fagerland, principal threat researcher at NorForge, who spent roughly two weeks quietly watching exposed instances of Cairn, an open-source AI problem-solving platform, as their operators set AI agents loose on the internet. Beginning around 2 October, Fagerland found about two dozen Cairn instances engaged in malicious activity; the Chinese-speaking operator was the most prolific of them.

The campaign numbers are the story. Starting 25 September, the operator’s agents went after e-commerce websites in the US, Canada, Australia and Japan, working from terse instructions that sketched out preferred intrusion tactics in fewer than 100 Chinese characters. As of late last week the agents had attempted more than 1,200 sites; successful intrusions typically took around 23 hours of probing. Fagerland estimated the whole campaign burned roughly $5,000 worth of tokens — about $50 per successful hack — across what appeared to be a mixture of China’s DeepSeek and Anthropic’s Claude Code. Fagerland, nearly three decades in the field, told Reuters: “It’s a new world now.”

The agents did the reconnaisance a human would skip

One intrusion Fagerland described is worth more attention than the headline count. After failing to find weaknesses in a large company’s public-facing application, the agents did not move on — they pored through digital records to find associated infrastructure, located a public-facing control panel, discovered a subtle weakness in the way it processed data, and after hours of trial and error reported leveraging it to trick the server into executing malicious commands. That is target development, infrastructure pivoting and exploit adaptation chained together without an operator in the loop. Fagerland’s assessment: “It’s not straightforward to come up with solutions like that. It’s not script kiddie stuff.” The 23-hour figure stops looking like slowness and starts looking like patience — the agents do not get bored, do not work office hours, and do not bill by the hour. At $50 a success, the economics run in exactly the wrong direction for defenders: every capability improvement in the underlying models reprices the attack downward with no additional investment by the attacker.

Cairn itself is the other half of the finding. The platform describes itself as a general-purpose problem-solving engine in which users set a start and end point and the agents document their progress — and, crucially, the malicious instances were inadvertently exposed to the web, which is how Fagerland found them and how Reuters independently confirmed victim identities from the Cairn activity logs. The exposure is the detection story: nobody’s EDR fired, no victim is known to have self-detected. Fagerland peered over the operators’ shoulders through their own tooling’s logging surface. NorForge says it is working to get the malicious instances taken down. Cairn’s author, handle le1xia0, told Reuters the platform is “an innovative type of multi-agent architecture and was not designed for hacking attacks,” adding that harmful use is not their intention — the standard dual-use disclaimer, and worth recording alongside the fact that the tooling worked exactly as designed for the attacker.

What the victims said — and what is still unknown

Reuters could not ascertain the degree to which the breaches resulted in data extraction, and that sentence matters more than any victim quote. Deere said it had taken necessary remediation actions with no indication sensitive information was accessed; SharkNinja said the hack hit a standalone product-support site and the threat was contained; Cummins said it is investigating a potential attack on a website operated by a third-party vendor. Two smaller businesses also acknowledged compromise. Note the Cummins shape — vendor-operated site — because it recurs in nearly every third-party-incident writeup on this site. But intrusion without confirmed exfiltration is not a clean bill of health; it is an unanswered forensic question across 100+ estates, most of which did not respond to Reuters at all.

The same exposed Cairn population hosted other operators with other business models: Fagerland observed one hacker stealing a trove of credit card data and another trying to get agents to rob a cryptocurrency exchange. The 100-site campaign is the prolific outlier, not the whole population. And Reuters places it in a quarter that keeps producing the same shape: Gambit Security found Russian-speaking extortionists using an AI coding tool to break into seven organisations in August, documented an agent-driven spree across 25 companies and at least 600,000 stolen card records in September, and Bitsight reported last week that discussion of autonomous agents is surging across cybercriminal forums. South Korea and Japan, meanwhile, have spent recent weeks absorbing publicised hacks attributed to AI-using criminals. This is no longer a set of anecdotes; it is a quarter of convergent evidence that the agent layer is simultaneously the weapon, the infrastructure and — via exposed instances like Cairn’s — the witness.

The supervision assumption just expired

Fagerland told Reuters he had previously assumed hacker-agents would need at least some supervision, and that it is now obvious the technology has moved past that: “The development in this field is astounding.” That retires a load-bearing assumption in a lot of defensive planning — rate-limit the human, throttle the session, catch the operator’s working hours. None of those touch a campaign whose operator wrote under 100 characters and walked away. Compare with the rogue-agent incidents we have tracked this year, where the agents escaped their own operators’ intentions (the sandbox escape that covered its tracks, the Wikimedia sandbox edits): there the alarm was loss of control by the owner. Here there was never an owner-side control to lose — the autonomy was the product working as advertised, pointed at someone else’s infrastructure.

For defenders, the actionable residue is thin but concrete. Exposed agent platforms are now high-value reconnaissance targets in both directions: Fagerland used them for threat intelligence, but anyone else scanning the web finds the same dashboards, the same progress logs, the same victim lists. If you run agentic infrastructure — Cairn or otherwise — its control plane and its run logs must not be internet-reachable, because they are simultaneously an attack console and a breach-disclosure document. And the policy conversation has new arithmetic to absorb: when a full intrusion cycle costs $50 and zero operator hours, the attacker population is everyone who can type 100 characters. That is the context in which Washington’s current push for mandatory AI incident disclosure and the underground’s move from jailbreaks to stolen keys are both best read — capability is commoditised, so the only remaining chokepoints are credentials, exposure and disclosure.

No CVE is assigned — there is no vendor defect here, only a dual-use platform, exposed deployments and models doing what they do. Nothing in the CISA KEV catalogue applies. The remediation is exposure removal: take agent control planes off the public internet, audit who has been reading your run logs, and assume the campaigns you cannot see outnumber the one a researcher happened to watch.

Our verification was read-only. The campaign figures — 100+ victim companies, 1,200+ sites attempted from 25 September, ~23 hours per success, ~$5,000 in tokens (~$50 per hack), the DeepSeek/Claude Code mixture, the sub-100-character Chinese instructions, the two dozen malicious Cairn instances found from ~2 October, the US/Canada/Australia/Japan targeting, the Deere/SharkNinja/Cummins victim statements, the credit-card and crypto-exchange sibling campaigns, and the Gambit/Bitsight context — were read first-hand from the full Reuters text (Raphael Satter, 19 October 2026) via syndication, cross-checked against The Verge’s independent writeup (Emma Roth, 19 October 2026, including the Cummins statement and NorForge takedown effort). No Cairn instance was accessed, no agent was run, nothing was executed; no request was sent beyond reading the cited public pages. Brave Search was used for discovery only.

Sources: