On October 19, 2026, The Verge and Reuters published reports within hours of each other: a single hacker had directed an army of largely autonomous AI agents to breach more than 100 corporate websites. The technical disclosure came from Norforge, which stumbled onto the campaign while examining an internet-exposed Cairn instance and went on to identify more than 20 "likely malicious" exposed instances in total - the hacker behind the 100-plus breaches being the most active operator among them. The playbook for the entire operation was startlingly thin. The attacker's preferred intrusion tactics fit in fewer than 100 Chinese characters. A successful intrusion took about 23 hours (per Reuters). And the total cost was a few thousand dollars (per Reuters). This is not the sci-fi fantasy of AI waking up on its own. It is one person, one open-source agent platform, and a production-line workflow.
The Timeline: How 23 Hours Unfolded
Start with the discovery chain. Norforge was the finder: while auditing exposed instances of the Cairn platform, it noticed one instance executing clearly anomalous tasks, widened the sweep, and eventually cataloged more than 20 "likely malicious" exposed instances. What these instances shared was glaring: deployed on the public internet with no meaningful access control, so anyone passing by could watch what task the agent was running and how far it had progressed. The hacker who breached more than 100 websites was the "most active" operator among this batch.
The victim list must be split by source. Norforge's official blog named no victim companies when it disclosed the campaign; the names John Deere, SharkNinja, and Cummins come from Reuters' reporting and confirmation. This is not pedantry. A discoverer declining to name targets is industry convention plus legal caution; an authoritative wire service's confirmation is the fact you can cite. Blend the two and misinformation starts.
The key numbers on tactics and cost also come from Reuters. The attacker's written "preferred intrusion tactics" ran to fewer than 100 Chinese characters - one paragraph serving as the complete campaign plan for an agent army. A single successful intrusion took about 23 hours: not 23 seconds of science fiction, not 23 days of siege warfare, but exactly the window where an autonomous loop can keep grinding while humans fail to react. The whole operation cost "a few thousand dollars." For comparison, a single external penetration test typically costs an enterprise several times that, and the average cost of handling one data breach runs into the millions. When the cost asymmetry between attack and defense stretches this far, defending with the old playbook stops working.
Two more details deserve a pause. First, the campaign was discoverable only because the instances were exposed - tasks, progress, and logs all sitting bare on the open internet. Had this hacker possessed even basic ops discipline and locked the instance inside a private network, Norforge might know nothing to this day, and 100-plus websites might still be compromised with nobody the wiser. Security people love to say "absence of evidence is not evidence of absence"; this is the textbook illustration. Second, "most active" implies there are less active operators too. Behind 20-plus malicious instances stand at least 20 attackers holding the same weapon, and 100 breached websites is the report card of just the busiest one. The others' progress has no public number. This story is very likely not over.
What Cairn Is: How a Problem-Solving Engine Became an Attack Orchestrator
To understand why this happened, you have to understand the attack vehicle, Cairn. It is an open-source project on GitHub (oritera/Cairn) that describes itself as a "general-purpose problem-solving engine." The design is not complicated: the user sets a starting point and an endpoint, the agent advances autonomously, logging its progress at every step until it reaches the goal or gives up. In essence, it productizes the universal pipeline of problem-solving: decompose the goal, execute, record, review.
On the straight path, this design is productivity: research, debugging, operations automation, multi-step investigation - all its home turf. But swap the objective and the same loop becomes an attack orchestrator. The hacker only had to supply three things: an endpoint for the agent (breach a given site), a short tactics brief (under 100 Chinese characters), and a budget (a few thousand dollars). Reconnaissance, probing entry points, falling back on failure, retrying along another path, logging progress - all the dirty work was done autonomously by the agent army. The two most labor-intensive parts of traditional attacks, repeated probing and patient waiting, happen to be what machines do best, without fatigue.
One thing must be stated plainly: Cairn is not a hacking tool. The project's author, @le1xia0, responded earlier this month that the platform "was never a hacking tool" and that "abuse is a human decision, not a feature of the engine." That characterization holds up logically: a knife can chop vegetables or hurt people, and the fault never lies with the blade. The real problem sits on the deployment side - the 20-plus malicious instances Norforge found were all exposed to the public internet, which is equivalent to leaving the control console of an automated attack machine out on the sidewalk. Norforge is now pushing to take these malicious instances down, but that is housekeeping. The phenomenon of exposed instances itself deserves the attention of everyone deploying agents.
Who Was in Command: A Human Hacker, Not a Self-Directed Model
A clear line has to be drawn here, because it determines the entire defensive posture. The previous hotspot piece covered a different category of event: model autonomy issues surfaced inside evaluation environments - a model exhibiting behavior nobody instructed, on its own. This case is the exact inverse. From start to finish, a human hacker was in command and the agent army was the executor. The human set the goal, wrote the tactics, paid the budget; the agent's job was to execute, fail, and retry without ever getting tired. The model did not "awaken." It was used as a lever.
Why does this line matter? First, the defensive target differs: what you defend against is the combination of a person and a platform, not a fantasy runaway model - so the defensive weight falls on access control, exposure management, and behavior monitoring. Second, the responsibility chain is clear: the hacker who wrote the tactics, the deployer who left instances naked on the public internet, and the platform that was abused - each party has its own account to settle. Third, policy discussions should not derail: this case proves not "AI is about to rebel" but "autonomous execution loops amplify one person's destructive reach by orders of magnitude." Defending against leverage is far more realistic - and far more urgent - than defending against awakening.
The distinction also shapes how to read the news cycle. Expect headlines to flatten the nuance into "AI hacks 100 companies," and expect a parallel chorus declaring that models have turned dangerous on their own. Neither reading survives contact with the facts. The agents here never chose a target, never invented a motive, and never deviated from the brief a human wrote for them. What they did do - and this is the genuinely new part - was compress weeks of manual intrusion work into a single day, at a price point low enough for an individual to absorb. Reading the event correctly is not splitting hairs; it decides whether security budgets flow toward speculative model-containment research or toward the unglamorous work of locking down deployments.
What Fell Were Websites, Not Intranets
One more point of precision: what was breached were websites, not corporate intranets, let alone core systems - and some of the sites were operated by third-party vendors. The corporate responses confirm that framing. Cummins' spokesperson said the company is "investigating reports of a potential attack on a website operated by a third-party vendor." John Deere said there is "no indication that sensitive information was accessed." SharkNinja said the affected property is a standalone product-support information site and the threat has been contained. The Verge sought comment from the companies involved; some requests went unanswered.
Note what the responses share: each company frames the incident around a web property, each stresses containment or limited access, and none describes compromised internal networks or stolen core data. That pattern is consistent with what an agent army can realistically achieve against hardened enterprises from the outside: takeover of public-facing properties rather than penetration of internal estates.
Do not relax at the words "just websites." Websites are the largest and softest slab of any company's exposed surface: they face the public internet directly, they accumulate years of legacy components, and they are often held by third-party vendors - the least visible link in the supply chain. A fallen website can mean defacement and redirect hijacking at the light end, and malicious content delivered to visitors, a phishing foothold, or a web server turned into a springboard for deeper intrusion at the heavy end. The three companies' responses all point to "limited impact" because discovery came early and the wording is careful - not because anyone has discovered a new theorem that website compromise does not matter. For defenders, vendor-operated sites are precisely the assets most likely to fall through the cracks: the main site has a security team watching it, while the corner sites hosted by suppliers often do not even appear on the asset inventory.
Exposed Instances: A Neglected Attack Surface and an Intelligence Goldmine
Norforge found this campaign only because the attackers were sloppy: the instances were on the public internet, and anyone could read the task and progress logs. That yields a double-edged fact - agent platforms are both the attacker's armory and potentially the defender's intelligence source. An exposed agent instance is a live broadcast of its own task queue: security researchers can watch for malicious tasks, other attackers can watch too, and with some luck they can take the instances over outright.
That leaves every team deploying agents a mandatory checklist. Authentication on every instance, even internal-only tools. Network positioning treated as production: no admin panels or task logs open to the internet. Egress control, with a whitelist of what the agent may and may not reach. Full audit trails, so the logs can answer who tasked the agent with what, and when. Secret hygiene kept separate, with platform credentials never mixed into the same config file as cloud credentials. Agent platforms are new; exposed instances are not a new problem. Database exposures, open object-storage buckets, exposed Kubernetes dashboards - every episode has been the same script, and this time the protagonist is simply an engine that does the work itself.
Why the Scales Are Tilting
Compress the whole incident into one sentence: a moderately skilled hacker, with a few thousand dollars and a tactics brief under 100 Chinese characters, leveraged a tireless agent army to breach more than 100 websites in roughly 23 hours. What deserves alarm is not the single-point loss but three levers being pulled to full extension at once. The skill lever: agents hand professional penetration-grade workflows to amateurs. The cost lever: a few thousand dollars against enterprise breach-handling bills in the millions - an exchange ratio ordinary pricing cannot capture. The scale lever: one operator can command several armies simultaneously, while defensive headcount does not multiply in step.
There is a colder reading too. The targets were all websites not because they hold the highest value, but because they offer the highest return on automation. The breach workflow for a website is highly templated - port scans, component fingerprinting, vulnerability attempts, privilege capture - every step has mature tooling and a clear success criterion, which is exactly what you can feed to an agent loop. Conversely, targets involving the physical world, interpersonal trust, or offline verification remain beyond agents for now. The lesson for defenders: any asset whose attack path can be templated will be agent-ified first. Whatever slice of your estate most resembles an assembly line is the slice to harden first.
For enterprises, the action list is concrete. Bring every vendor-operated site into the asset inventory and vulnerability management program; leave nothing unowned. Run an exposure self-audit of web assets, using the same route Norforge took to find the malicious instances. Add agent behavior patterns to traffic monitoring - high-frequency retries, regular progress logging, automation tool fingerprints. Write "the adversary is an AI agent" into the assumptions of your incident-response plan. As for open-source agent platform developers: the Cairn author's line that "abuse is a human decision, not a feature of the engine" is logically sound, but platform maintainers can still do engineering - tighten default configurations, put security notices on the first screen of deployment docs, and ship a prominent exposure alert for instances. Make the "human decision," at minimum, an informed one.
References
- Norforge official blog (discoverer; technical details and exposed-instance sweep): https://norforge.com/blog/inside_cairn
- The Verge, Oct 19, 2026 (Emma Roth; corporate and platform responses): https://www.theverge.com/ai-artificial-intelligence/1013643/ai-agents-hack-john-deere-shark-ninja-cummins
- Reuters, Oct 19, 2026 (victim confirmation; cost and duration figures): https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/
- Cairn open-source repository (oritera/Cairn; author's response in project discussions): https://github.com/oritera/Cairn
Related reading
- No permission, AI got it anyway: OpenAI's four confessions: No permission, AI got it anyway: OpenAI's four confessions
- Five always-on agents, compared: who takes the night shift: Five always-on agents, compared: who takes the night shift
- 30,000 Merges a Day: Why Anthropic Ditched Git: Anthropic Ditched Git Because of Its Own Agents