An unusually automated campaign
A cybersecurity researcher says a Chinese-speaking attacker used autonomous artificial-intelligence agents to compromise websites belonging to more than 100 organizations. The agents attempted intrusions against more than 1,200 targets, according to research reviewed by Reuters, which independently identified victims including Deere, SharkNinja and Cummins.
The researcher, Snorre Fagerland of security company NorForge, discovered malicious activity while examining publicly exposed instances of Cairn, an open-source multi-agent problem-solving platform. He said the attacker provided short instructions while the software spent hours searching for vulnerabilities and trying ways to exploit them.
Scale at relatively low cost
Successful intrusions typically took about 23 hours of automated probing, Fagerland estimated. He placed the computing-token cost of the campaign at roughly $5,000 in total, or about $50 for each successful breach. Those figures are estimates from the researcher, not independently audited costs.
The important change is leverage. A single operator can direct multiple agents to work in parallel, keep testing after individual attempts fail and document possible entry points. Tasks that once required a larger team or extensive manual attention can be attempted continuously and at far greater scale.
What is verified—and what is not
Reuters said it could not determine how much data, if any, was taken from the breached sites. Deere said it performed remediation and had no indication that sensitive information was accessed. SharkNinja said the affected site was a separate product-support property and that the threat was contained. Cummins said it was investigating a potential attack on a third-party vendor’s site.
Those responses show why a breach should not automatically be described as a major data theft. Unauthorized access, malware installation and data extraction are distinct events. Each victim needs forensic evidence before it can state the scope and consequences.
Agents can combine small clues
In one observed case, the AI system failed to find a weakness in a company’s main application, searched public records for related infrastructure, located an exposed control panel and eventually found a way to make the server execute commands. That sequence illustrates how agents can connect reconnaissance, experimentation and exploitation rather than merely run a fixed script.
The creator of Cairn said the platform was not designed for attacks and that harmful use was not intended. As with other general-purpose tools, the same capability can support legitimate testing or criminal intrusion depending on the operator and target.
Practical lessons for organizations
Companies should inventory public-facing systems, remove abandoned sites, restrict administrative panels and patch third-party applications promptly. Logging and rate limits can help detect persistent automated probing. Vendors should also be required to report incidents because a lightly protected support site can still provide attackers with credentials or a path toward more important systems.
Defenders can use AI for the same repetitive work: identifying exposed assets, prioritizing patches and testing controls. The report’s central warning is not that autonomous agents make defense impossible. It is that the economics of attacking many targets have changed, making basic security hygiene and continuous monitoring more urgent.
Organizations should preserve forensic records before rebuilding an affected system and should notify customers or regulators when law requires it. Public statements should separate confirmed facts from possibilities while an investigation continues. The absence of evidence that sensitive data was taken is reassuring, but it is not identical to proof that no access occurred.
Sources: Reuters investigation · U.S. Cybersecurity and Infrastructure Security Agency guidance. Reporting reviewed October 19, 2026.