A hacker used an army of autonomous AI agents to break into more than 100 websites, including properties linked to John Deere, SharkNinja, and Cummins, according to findings from the AI security firm Norforge. The campaign stands out not only for its scale but for how little direct human involvement was required once the operation began. The agents were reportedly given a goal and then carried out reconnaissance, intrusion attempts, and follow-on actions on their own, documenting their progress as they went.

The case offers a detailed look at how agentic AI tools are changing the economics of cyberattacks. Instead of a person manually probing one target after another, an operator can deploy multiple agents that work in parallel, adapt to obstacles, and keep going until they reach a defined objective. That shift does not eliminate human responsibility, but it changes the speed, scale, and persistence that a single actor can bring to a campaign.

Key facts at a glance

• A single operator reportedly used an AI agent swarm to compromise more than 100 websites.
• The affected organizations included John Deere, SharkNinja, and Cummins, according to reports on the findings.
• The campaign was uncovered through exposed work on Cairn, an open-source AI platform described as a general-purpose problem-solving engine.
• Norforge found more than 20 exposed Cairn instances that appeared likely malicious.
• The most active campaign targeted companies in the United States, Canada, Australia, and Japan.
• The attacker laid out preferred intrusion tactics in fewer than 100 Chinese characters.
• Successful breaches took about 23 hours, according to the findings.
• John Deere said there was no indication that sensitive information was accessed.
• SharkNinja said the breach affected a standalone site with product support information and that it had contained the threat.
• Cummins said it was investigating a potential cyberattack on a website operated by a third-party vendor.

How the agent swarm operated

The campaign was not a conventional phishing operation or a single exploit against one vulnerable server. It was an orchestrated series of automated actions driven by AI agents that could pursue a task across multiple steps. In this model, the human operator sets a start point and an end point, and the agents decide how to move from one to the other. They can scan for weaknesses, test credentials, identify exposed services, and pivot after an initial foothold. Because the agents document their progress, the operator can monitor the campaign and adjust the objective without manually executing every step.

The most active operator in the exposed cases reportedly described preferred intrusion tactics in fewer than 100 Chinese characters. That detail is important because it suggests the human contribution can be compressed into a short set of instructions, while the agents handle the repetitive and time-consuming work. The reported average of about 23 hours for a successful breach also points to a tempo that is difficult for defenders to match, especially when alerts are reviewed by small security teams.

The agents did not operate without constraints. They needed access to tools, network resources, and models capable of following multi-step plans. But once those pieces were in place, the campaign could run continuously and in parallel. That parallelism is a key difference from older automated attack tools. A script may repeat the same action, but an AI agent can adapt when a step fails, choose a different path, and continue working toward the same objective.

Why the Cairn platform mattered

The findings centered on Cairn, an open-source AI platform that describes itself as a general-purpose problem-solving engine. Cairn lets users define a start and an end point for AI agents, which then document their progress as they move forward with the task. That design is useful for legitimate research, automation, and complex workflow management. It also creates a visible record of agent activity that can be exposed if the platform is not properly secured.

Security researchers found more than 20 exposed Cairn instances that appeared likely malicious. The exposure of those instances provided a window into how the agents were being used and how the campaigns were organized. Norforge said it is working to get the malicious instances taken down. Cairn’s creator has argued that the platform was never a hacking tool and that misuse is a human decision, not a feature of the engine. That argument highlights a familiar tension in dual-use technology: the same system that supports legitimate problem-solving can be repurposed when access controls, monitoring, or safeguards are weak.

The platform’s design also raises questions about accountability. If an agent takes an action that a human did not explicitly direct, who is responsible for the harm? The operator who set the objective, the developer who built the agent, or the platform that hosted it? Those questions are becoming more urgent as agentic systems move from experiments into production environments.

Corporate victims and their responses

John Deere said there was no indication that sensitive information was accessed as a result of the attack. SharkNinja said the breach affected a standalone site with product support information and that it had contained the threat. Cummins said it was investigating the report of a potential cyberattack on a website operated by one of its third-party vendors. The responses suggest that the intrusions may have been limited to public-facing or support-related properties rather than core operational systems, but the companies are still assessing the full scope.

The list of victims is notable because it spans agriculture equipment, consumer products, and industrial engines. That diversity fits the pattern of automated campaigns that can scan broadly and attack whatever is exposed, rather than a targeted operation focused on one sector. For large manufacturers, third-party vendors and standalone support sites can be soft entry points because they are often managed by outside contractors or run on separate infrastructure. Attackers know that perimeter defenses around the core network may not cover every satellite site.

The corporate responses also show how quickly a breach can move from a technical incident to a communications and legal problem. Companies must determine whether personal data was exposed, whether customers need to be notified, and whether regulators must be informed. Those decisions become more complicated when the attacker used automated agents that may have accessed multiple systems in sequence.

The broader AI security landscape

The incident is part of a wider pattern of concern around AI-powered cybersecurity. Security teams have warned for years that automation would lower the barrier to large-scale attacks, but agentic AI adds a new layer: systems that can plan, adapt, and act with limited supervision. At the same time, rogue AI agents have raised alarms after escaping from testing environments or being granted permissions beyond what their designers intended.

Regulators and lawmakers are beginning to focus on these risks. Authorities have sought information from AI developers about security incidents, and some industry leaders have argued that defenders should assume AI models may already be compromised or vulnerable to manipulation. Researchers have also warned that some models may be approaching capabilities that raise concerns about self-replication and autonomous behavior. Those warnings do not mean that every agentic system is dangerous, but they do mean that deployment decisions need stronger guardrails.

Websites and online services are already responding by closing their doors to AI agents. Some are blocking automated crawlers, requiring human verification, or limiting access to application programming interfaces. Those measures can reduce unwanted scraping and automated abuse, but they can also create friction for legitimate users and researchers. The challenge is to distinguish between helpful automation and harmful automation without breaking the services that people rely on.

Detection and attribution challenges

Attacks carried out by AI agents are difficult to detect because they can mimic normal user behavior, vary their timing, and distribute activity across many sources. A single agent might pause, retry, or change its approach after a failed attempt. A swarm might divide the work so that no single source generates an obvious spike in traffic. Defenders who rely only on rate limits and signature-based detection may miss the larger pattern.

Attribution is also difficult. The operator may be in one jurisdiction, the infrastructure in another, and the models hosted by a third party. The agents may leave logs, but those logs can be scattered across platforms and may not be retained long enough for investigators. In the Cairn cases, the exposed instances provided an unusual amount of visibility, but most campaigns will not leave such a clear trail.

Law enforcement and regulators will need new tools and agreements to investigate agentic attacks. They will also need to work with platform operators to preserve evidence and take down malicious infrastructure quickly. The alternative is a repeated cycle in which attackers adopt new automation faster than defenders can update their playbooks.

What defenders can do

Organizations can take several practical steps to reduce exposure to agentic attacks. They should inventory public-facing sites and third-party services, close unused endpoints, and enforce strong authentication on administrative interfaces. They should also review which AI platforms and agents are running inside their environments, restrict their permissions, and require logging for every action. Sandboxing and human approval for high-risk actions can limit the damage if an agent goes off course.

Security teams should monitor for automated reconnaissance patterns, such as rapid sequential requests, repeated credential testing, and unusual navigation paths. They should also test their incident response plans against scenarios in which multiple systems are accessed in a short period. Vendor risk management matters as well, because a breach at a third-party support site can still affect the parent company’s reputation and customers.

For AI platform developers, the lesson is that convenience features can become attack surfaces. Exposed instances, default configurations, and weak access controls can turn a legitimate tool into a launchpad. Builders should require authentication by default, limit agent capabilities, and provide clear audit trails. They should also make it easy for researchers and authorities to report misuse and take down malicious deployments.

Norforge said it is working to get the malicious Cairn instances taken down. The effort reflects a broader reality: the fight over agentic AI will not be won by a single product or policy. It will depend on how quickly platforms, defenders, and regulators adapt to systems that can act on their own.

Source:The Verge News