Quick Answer
AI agents were used in a campaign that breached more than 100 company websites, researchers and Reuters found. The Cairn system can coordinate agents that investigate targets, search for weaknesses, and attempt break-ins. Companies should review exposed web assets, rotate credentials, and investigate unusual access activity because low-cost automated attacks can test many targets quickly.
Key Takeaways
- NorForge found more than 20 exposed Cairn control panels linked to suspected malicious activity.
- Reuters independently identified more than 100 companies affected by the campaign.
- The largest cluster contained more than 1,100 attack projects across 14 dashboards.
- NorForge estimated a Cairn task cost roughly $5, including unsuccessful attempts.
- Organizations should treat exposed credentials and unusual website activity as urgent security issues.
What happened in the AI agent website hacking campaign?
AI agents were used to investigate and breach more than 100 company websites in a newly disclosed cybercrime campaign. Reuters independently identified more than 100 affected organizations, including Deere, SharkNinja, and Cummins, after examining activity tied to the Cairn AI system. The campaign matters because the operators appear to have used automation to move from target research to attempted access with limited human input.
Cairn is described as an AI-powered, state-based problem-solving system that can coordinate agents to investigate targets, look for weaknesses, and attempt break-ins. NorForge published its Inside Cairn investigation on October 19, 2026, after finding more than 20 publicly exposed control panels that it assessed as likely connected to malicious activity. Exposed dashboards gave researchers a view into how operators assigned tasks and monitored attack projects.
The campaign does not mean every AI assistant can autonomously compromise a website. The reported activity involves a specific system, configured by operators with malicious intent and connected to target information, credentials, and attack workflows. The practical concern is that AI agents can reduce the time required to repeat reconnaissance and access attempts across a large number of websites.
Website owners should review internet-facing systems, administrative panels, third-party integrations, and credentials that may have been exposed. Organizations that find suspicious access records should preserve logs before making broad changes, then involve their security team, hosting provider, or incident-response firm if the activity suggests an active compromise.
How did the Cairn AI agents appear to operate?
The Cairn AI agents appear to have operated as coordinated task systems rather than as a single chatbot receiving one instruction. NorForge describes Cairn as a state-based problem-solving platform that can assign agents to investigate a target, search for vulnerabilities, and continue toward an access objective. That structure matters because each task can build on earlier results instead of requiring an operator to manually restart the process.
The largest identified cluster, designated AIA0001, used Chinese-language instructions and contained more than 1,100 attack projects across 14 dashboards, according to NorForge. The cluster primarily targeted e-commerce and payment infrastructure in the United States, Japan, and Australia. NorForge assessed the apparent goal as obtaining persistent access that could later support monetization.
| Reported campaign detail | What researchers found | Why it matters |
|---|---|---|
| Control panels | More than 20 publicly exposed Cairn panels | Researchers could examine task activity and exposed data. |
| Largest cluster | More than 1,100 projects across 14 dashboards | Automation supported activity at a scale that is difficult to manage manually. |
| Primary targets | E-commerce and payment infrastructure | Those systems can provide access to valuable accounts and business operations. |
| Estimated success rate | Near 10% | A modest success rate can still create serious harm when many targets are tested. |
AI agents do not remove the need for operators to choose targets, supply goals, or act on useful access. However, the automated workflow can make repeated targeting more practical. Companies should make sure website logs, administrator access records, and third-party vendor activity can be reviewed quickly if a suspicious pattern emerges.
Which companies were affected by the AI agent campaign?
More than 100 companies were identified as breached in the AI agent campaign, although the reported impact differed by organization. Reuters identified Deere, SharkNinja, and Cummins among the companies connected to the activity. The public disclosures do not establish that every affected organization lost the same type or amount of data.
Deere said it took remediation actions and had no indication that sensitive information was accessed. SharkNinja said the affected standalone product-support website was contained. Cummins said it was investigating a potential attack involving a third-party vendor’s website. The different responses show why a website breach does not automatically prove that a company’s core systems or customer records were accessed.
The campaign is still significant because internet-facing support sites, payment services, and vendor-connected systems can become paths into broader business operations. Organizations should not assume a less prominent website is harmless simply because it is separate from the main corporate domain. A standalone site can still contain credentials, customer communications, software components, or connections that require investigation.
Consumers who receive unexpected password-reset emails, payment notices, or support messages should verify the request through a known company website or official app. Users should avoid following links in unexpected messages, particularly while companies are investigating website incidents. Readers concerned about automated account abuse can also review how AI scam detection tools are being added to consumer messaging services.
Why do AI agents make website attacks cheaper to scale?
AI agents can make website attacks cheaper to scale because one operator can direct automated systems to repeat research, testing, and follow-up tasks across many targets. Reuters reported that the most prolific operator attempted more than 1,200 sites after September 25, 2026, using instructions of fewer than 100 Chinese characters. The short prompts suggest the system handled much of the detailed task execution after receiving a broad objective.
NorForge estimated that an average Cairn task cost roughly $5, including unsuccessful attempts. Reuters reported an estimated campaign token cost of about $5,000, or roughly $50 per successful hack. Those estimates are not a fixed price list for cybercrime, but they illustrate why attackers may see automated systems as a way to test more targets with limited spending.
NorForge estimated a success rate near 10% and found that successful AIA0001 projects reached their stated objective in a little under 23 hours on average. A 10% rate is not high for any single victim, but the risk changes when an operator can attempt access repeatedly across a large target list. The most important point is that scale can turn a relatively low per-target success rate into a substantial number of compromises.
Organizations should prioritize controls that reduce repeated access attempts, including strong administrator authentication, credential rotation, prompt patching, and review of externally exposed services. Security teams should also avoid treating AI-enabled attacks as a wholly new category. The same basic weaknesses, such as exposed secrets and poorly protected web applications, remain useful to attackers.
What security weaknesses did researchers find in Cairn panels?
Researchers found hundreds of exposed secrets in Cairn control panels, and SecurityWeek said 11% of those secrets were verified as valid. Exposed secrets can include credentials or tokens that allow access to online services, depending on how the operator configured a system. The finding matters because leaked access data can create additional risk beyond the original attack project.
SecurityWeek said at least three threat-actor clusters were abusing Cairn for financial theft or persistent access. Persistent access means an attacker seeks a way to return to a system later, rather than using a single opportunity and leaving immediately. That objective can make detection harder because suspicious activity may be spread across a longer period.
The exposed panels also show a basic operational problem for attackers: systems used to automate intrusions can expose their own data when configured carelessly. Defenders should not rely on attacker mistakes, but security teams can use publicly available indicators to assess whether their domains, credentials, or services appear in related activity. The SecurityWeek analysis of the Cairn activity provides additional detail on the exposed secrets and cluster findings.
Organizations that discover leaked API keys, passwords, session tokens, or cloud credentials should revoke and replace them promptly. Security teams should stop and contact the relevant cloud provider, software vendor, or incident-response specialist if the credentials could provide access to production systems, payment services, or customer data.
How should companies respond to suspected AI agent attacks?
Companies should respond to suspected AI agent attacks by preserving evidence, limiting unauthorized access, and checking whether exposed systems share credentials or connections with more important services. The reported campaign targeted websites and related infrastructure, so a response should examine web logs, administrator accounts, third-party vendors, and application credentials rather than focusing only on a homepage.
- Preserve web server, application, identity, and cloud access logs before deleting or rotating data.
- Review administrator accounts, API keys, service accounts, and recent authentication events for unknown activity.
- Rotate credentials and revoke tokens that may have been exposed or used outside expected locations.
- Check third-party support, payment, and vendor-connected websites for shared accounts or trust relationships.
- Contact the hosting provider, security vendor, or incident-response team if evidence suggests unauthorized persistence or data access.
Organizations should back up critical configurations and logs before making major changes to web services. Removing evidence too early can make it harder to determine what happened, which accounts were used, and whether an attacker still has access. A previous incident involving compromised update infrastructure also showed why organizations need to examine trusted external systems during an investigation.
Normal users should not attempt to investigate a company website or test suspected vulnerabilities themselves. Unauthorized testing can disrupt services and complicate an active investigation. The appropriate stop line is clear: employees should report suspicious activity through their company security channel, while website owners should bring in qualified incident responders when they cannot confirm the scope of access.
What does the campaign mean for consumers and online shoppers?
The AI agent website hacking campaign means consumers should be more careful with unexpected messages that appear to come from stores, payment services, or product-support websites. The reported targets included e-commerce and payment infrastructure, which can make fraudulent follow-up messages more convincing if attackers obtain access to a legitimate service or customer contact channel.
Consumers should use unique passwords for important shopping, banking, and email accounts, then enable available multi-factor authentication. Unique passwords limit the damage if one website account is exposed, because an attacker cannot automatically reuse the same password elsewhere. A password manager can make this approach more practical, especially for people managing many retail accounts.
Consumers should also verify support requests by opening the company’s official app or typing the known website address directly into a browser. An unexpected request for a password, payment card, verification code, or account recovery approval deserves extra scrutiny. Reports of more complex text scams show why message content alone is no longer a reliable sign that a request is legitimate.
Account holders who believe an online retailer or payment service was compromised should change the account password, review recent orders and saved payment methods, and contact the company through an official support channel. Consumers should contact their bank or card issuer promptly if they find unauthorized transactions or believe payment information may have been misused.
FAQ
Were AI agents responsible for more than 100 website breaches?
Yes, Reuters independently identified more than 100 companies breached in the campaign involving the Cairn AI system. The reported activity involved human operators using AI agents to investigate targets and attempt access, not an AI system acting without direction.
What is the Cairn AI system?
Cairn is an AI-powered, state-based problem-solving system that can coordinate agents to investigate targets, search for weaknesses, and attempt break-ins. NorForge found more than 20 publicly exposed Cairn control panels it assessed as likely linked to malicious activity.
How much did the reported AI hacking campaign cost?
The reported campaign cost about $5,000 in tokens, or roughly $50 per successful hack, according to Reuters. NorForge separately estimated an average Cairn task cost of roughly $5, including unsuccessful attempts.
Did the campaign expose customer data at every affected company?
No, the available reporting does not establish that every affected company lost customer or sensitive data. Deere said it had no indication sensitive information was accessed, while other companies described containment or ongoing investigation efforts.
What should a website owner do after suspected unauthorized access?
Website owners should preserve logs, review privileged accounts, rotate exposed credentials, and investigate third-party connections. Website owners should contact a qualified incident-response provider or relevant vendor if there is evidence of persistent access, data exposure, or compromised production systems.