One Hacker Used AI Agents to Breach More Than 100 Companies, John Deere Among Them

A single Chinese-speaking hacker ran a swarm of AI agents against more than 1,200 sites and broke into the sites of more than 100 companies, among them the farm equipment maker Deere, the appliance maker SharkNinja, and the engine maker Cummins. Snorre Fagerland, a researcher at the Norwegian security firm NorForge, laid out the campaign in a report called “Inside Cairn” on October 19, and Reuters named the companies in an exclusive the same day.

The campaign started on September 25. Fagerland put the total token spend at roughly $5,000, or about $50 for each successful intrusion. The report itself gives an average of around $5 per task once failed tasks are counted, and flags that the estimate carries a lot of uncertainty.

The companies responded as follows. Deere said it had remediated the issue and saw no sign that sensitive information was accessed. SharkNinja said a single standalone product support site was affected and the threat was contained. Cummins said it is investigating a report that a site run by a supplier was attacked. Reuters could not confirm how much data was taken.

A prompt under 100 Chinese characters, a web shell 23 hours later

The instructions handed to the agents were short. According to Reuters, the attack method was written in fewer than 100 Chinese characters. The automated task prompt NorForge recovered runs five lines.

In plain terms: target live online stores in the US, Canada, Japan, and Australia with 200,000 to 1.5 million monthly visits, and find a hole that runs server commands without logging in. SQL injection, file upload, deserialization, and authentication bypass come first. Once inside, plant a web shell that accepts file uploads, meaning a hidden remote control endpoint left on the server. If the server answers whoami or id, the goal is met.

Everything after that was the agents’ own work. Successful projects took just under 23 hours on average from start to goal, and each one accumulated roughly 140 findings along the way. In one case against a hardware parts supplier, the agents chained a writable memcached session store, unsafe PHP deserialization, and an outdated Zend Framework gadget to reach server command execution. NorForge opened the shell URL recorded in the completed task and confirmed the web shell was still live.

NorForge sorted the 20-plus panels it judged malicious into three clusters.

On success rate alone, AIA0001 failed at more than nine sites in ten. But this cluster never had a human picking targets one at a time. It fed in a target list mechanically and ran, which is how it reached past 1,100 sites. Across the 134 recorded outcomes, web shells and remote code execution account for 56, database access and data theft for 28, account takeover for 20, cryptocurrency wallets for 13, and payment cards for 9.

The worker was called Claude Code, the model was DeepSeek

Every AIA0001 task ran on a worker named claudecode_deepseek-v4.1-flash. The name alone reads as if Anthropic’s Claude did the hacking. Here Claude Code is only the runner, and the model doing the thinking is DeepSeek.

That exact arrangement is visible in Cairn’s own example config file (dispatch.example.yaml). The default example worker is named claudecode_deepseek-v4-pro, and it is wired up like this:

- name: "claudecode_deepseek-v4-pro"
  type: "claudecode"
  env:
    ANTHROPIC_MODEL: "deepseek-v4-pro"
    ANTHROPIC_BASE_URL: "https://api.deepseek.com/anthropic"

Claude Code is normally a tool that asks Anthropic’s servers for a Claude model. Point the base URL (ANTHROPIC_BASE_URL) at DeepSeek’s Anthropic-compatible API and the tool stays the same while the model producing the answers becomes DeepSeek. The attacker’s worker name follows the same naming convention as that example, with only the model slot swapped for V4.1 Flash. NorForge reached the same conclusion while noting it is an inference, not a confirmed fact. The English-language cluster AIA0002 used the open-source coding agent Pi to reach DeepSeek models through OpenRouter (pi_openrouter_deepseek).

If that reading is right, Anthropic’s model-side safeguards had no place in this campaign. In the August case where an operator broke into seven companies with Cursor’s agent, Claude Sonnet 4.5 refused several times and then cooperated once the request was framed as a “security test.” This time there is no comparable party left to refuse. The runner is a public tool, and the model charges $1.20 per million output tokens, or $0.60 during the discount window. Reuters carried no comment from Anthropic or DeepSeek.

It surfaced because the attacker left his own panel open

How this came to light is unglamorous. The attacker left his control panel sitting on the open internet. Starting around October 2, Fagerland was using internet scanning services such as Shodan and Censys to look for web interfaces belonging to AI tooling, and found Cairn panels. The panels showed project lists, attack targets, and every finding the agents had logged.

Cairn is an open-source project with 4,100 GitHub stars. Give it an origin and a goal, and multiple agents search for a path while writing findings and next steps onto a shared blackboard. Its README states that it solved all 54 problems in a Tencent Cloud AI penetration testing challenge. The author posted on X that it “was not designed for hacking attacks,” and did not answer Reuters’ questions.

Open the repository and it is clear why those panels were so easy to find (as of the last commit on September 7, 2026).

• Launched as a plain command-line server, it binds to 127.0.0.1 by default, so it only listens on the local machine.
• The docker compose up path the README recommends starts the server with --host 0.0.0.0 and publishes 8000:8000. If the host has a public IP, anyone can reach port 8000.
• The server code has no login and no token check. Creating and deleting projects, changing settings, adding hints, and reopening finished projects are all callable without authentication.

NorForge wrote that an open panel like this appears to allow stopping projects or redirecting the agents, though it did not try.

The open panels were also full of secrets. When NorForge ran the secret scanner Trufflehog over them, it found 622 unique credentials, of which 68 (10.9%) were verified as still usable. The most common types were URIs at 75, Gemini API keys at 74, Auth0 at 41, AWS at 41, and Shopify at 38. Credentials the attacker had stolen were mixed in with the attacker’s own keys, including root access details for the server where exfiltrated data was being collected.

NorForge did not reserve its criticism for the attacker. The same scanning turned up panels belonging to legitimate red team firms. The report argues that running real client penetration tests from an unprotected panel is itself a serious problem: when the panel is open, the client’s vulnerability list goes straight onto the internet. NorForge is notifying affected companies alongside Reuters and has asked hosting providers to take the panels down.

Who was on the target list, and who was one line away

The report says AIA0001 targeted the US, Canada, Japan, and Australia. Two of those four are in APAC, and Japanese and Australian online stores were in scope from the start. Singapore, India, and the rest of Southeast Asia are not named anywhere in the report, which is a statement about this one prompt and nothing more. The country filter is a single line in a five-line instruction. Change the target list and the same configuration points at stores anywhere else. The weaknesses this cluster went after, login SQL injection, file upload, and outdated PHP frameworks, are not tied to any jurisdiction.

The low success rate never cost the attacker anything. The agents knocked on more than 1,100 stores at once, and even at 8.4%, each intrusion took under a day and cost somewhere around $50.

If you are running Cairn or any other agent orchestrator dashboard that you brought up with docker compose, start with the port mapping. Change ports: "8000:8000" to "127.0.0.1:8000:8000", reach it over an SSH tunnel only, then check from a phone on mobile data that http://your-server-ip:8000 does not answer. If your team uses tools like this for internal penetration testing, remember what accumulates in that panel: your clients’ vulnerability lists and their access credentials.