🔍 Read the full analysis: The $50 Break-In: AI Agents And The Reach Of One Hacker on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security researcher and Reuters documented an operation in which a Chinese-speaking operator used Cairn, an open-source AI-agent platform, to probe online shops from late September into October. Reuters identified break-ins at websites of more than 100 companies, while the amount of data accessed or taken remains unknown.
A Chinese-speaking operator used AI agents running on the open-source platform Cairn to probe online shops in several countries, with Reuters reporting break-ins at the websites of more than 100 companies. The activity began around September 25 and had reached more than 1,200 targeted sites by mid-October, according to records reviewed by Reuters and security firm NorForge; it is not clear how much information, if any, was taken.
NorForge researcher Snorre Fagerland found exposed Cairn control panels while looking for internet-accessible dashboards used to coordinate AI agents. NorForge says it identified more than 20 panels it linked to likely malicious activity. The panels let Fagerland observe the agents’ work, and the firm grouped the activity into three clusters. Its report, published October 19, describes the largest cluster as AIA0001.
NorForge counted more than 1,100 attack projects across 14 panels in that cluster, aimed mainly at targets in the United States, Japan and Australia. Reuters separately reviewed Cairn activity records and identified affected companies, including farm-equipment maker Deere, appliance maker SharkNinja and engine maker Cummins. Reuters reported that two smaller businesses acknowledged being compromised; other companies contacted by the news organization did not respond.
NorForge measured successful AIA0001 projects as taking a little under 23 hours on average, with one lasting more than five days. Researcher Fagerland estimated the campaign’s AI costs at about $5,000, or roughly $50 per successful intrusion, but NorForge described the estimate as subject to considerable uncertainty. These figures are estimates, not audited accounting of the operator’s spending.
One operator, a swarm of agents
The campaign in numbers
What the researcher and Reuters report about the busiest group NorForge found. Counts come from the attackers’ own exposed panels; cost and success figures are estimates.
The price tag estimates
NorForge / Fagerland, “uncertainty considerable”
- ~$5 per task on average, including tasks that fail early
- $100+ for long projects with more than 1,000 intents and facts
- ~$5,000 in AI costs for the campaign, about $50 per successful hack
- ~10% success rate, NorForge’s “reasonable assumption”
How the swarm runs
Simplified, no attack details
- Shop websites are ranked by traffic and checked automatically in a browser
- Each target becomes a Cairn project: a starting point and a goal
- Agents post facts and next steps on a shared board and build on each other
- Goal: a hidden way back in to shop and payment systems, for later
- 22 SepGambit reportGambitCairn found among three AI harnesses on a criminal’s staging server (separate campaign)
- 25 SepCampaign startsReutersA Chinese-speaking operator turns agents on shops in the US, Canada, Australia and Japan
- ≈ 2 OctOpen panels foundReutersFagerland starts finding Cairn panels in malicious use, about two dozen
- mid-Oct1,200+ sites triedReutersBreaks into websites of 100+ companies, incl. Deere, SharkNinja, Cummins
- 19 OctReport and investigationNorForge · ReutersNorForge publishes “Inside Cairn”; Reuters publishes its investigation
Sources: NorForge, Inside Cairn (19 Oct 2026); Reuters (19 Oct 2026); Gambit Security (22 Sep 2026). Numbers as published, same rounding as the article.
Powered by Thorsten Meyer AI
Lower-Cost, Longer-Running Intrusions
The reporting points to a change in the scale at which one operator can conduct reconnaissance: software agents can work through many targets and share findings, reducing the need for a person to guide every step. The evidence here concerns a particular operation, not proof that AI agents can reliably break into any website or replace human attackers.
NorForge’s account suggests the operation sought persistent access to e-commerce or payment infrastructure for possible later monetization. That is the firm’s interpretation of the activity, rather than confirmation that the operator sold access or used it to steal payment data. For companies, the incidents underscore the risk posed by less prominent web assets, including product-support pages and sites run by third-party vendors. The affected firms’ statements and Reuters’ reporting do not establish that customer or payment information was taken.
Automated activity can also increase the burden on defenders, who may have to review more alerts and distinguish coordinated attacks from legitimate traffic. The incident raises practical questions for security teams about how to track agent activity and protect exposed administrative panels, even when the operator’s identity and ultimate purpose are unknown.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How Cairn Panels Exposed Activity
The reporting grew out of an earlier investigation by Gambit Security. In September, the firm said it recovered a criminal staging server containing three “AI harnesses”—programs that let AI models carry out tasks—including Cairn. NorForge then searched for internet-indexed Cairn dashboards. The firm says most require authorization, but it found some panels with no password protection.
From around October 2, Fagerland identified roughly two dozen panels linked to malicious activity, Reuters reported. NorForge published its findings on October 19, the same day Reuters published its investigation. NorForge’s report names no victims; Reuters says it identified companies by independently reviewing activity records and contacting them.
Cairn is a general-purpose, open-source agent platform, not a tool designed exclusively for hacking. Its author, who uses the name le1xia0, told Reuters that Cairn was not designed for hacking attacks and that harmful use was not the author’s intention. In this operation, the platform’s shared records allowed agents to build on information and plans recorded by other agents.
“Cairn was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention.”
— Cairn author le1xia0, quoted by Reuters
Data Access and Operator Identity
The operator’s identity has not been established. NorForge describes the actor as Chinese-speaking; that does not identify the person or prove where they are located. The source material reports no arrest or criminal charge. Reuters also could not establish how much data, if any, was accessed or taken, or whether the reported access led to payment-data theft, financial losses or later misuse.
Company statements offer limited detail. Deere said it had no indication that sensitive information was accessed. SharkNinja told Reuters that a standalone product-support site was affected and that the threat had been contained. Cummins said it was investigating a potential attack on a third-party vendor’s website. Those accounts do not resolve whether data was exposed across the broader set of reported incidents.
The estimated $5,000 campaign cost and roughly $50 per successful intrusion are NorForge’s calculations, and the firm warns of considerable uncertainty. The available reporting also does not establish whether the operator acted alone, what specific AI models were used, or whether any access was monetized.
Company Reviews and Security Findings
The affected companies may provide further information as their investigations continue, particularly about what systems were accessed and whether any information was exposed. Cummins said it was investigating; SharkNinja said the threat was contained, while Deere reported taking remediation steps. The reporting provided no timetable for additional company findings.
Security researchers and organizations will also be watching for further evidence about exposed Cairn panels and related activity. NorForge’s report identifies three activity clusters, but the material available here does not establish whether they share an operator or are part of a wider coordinated campaign. Until companies or investigators release more findings, the scale of confirmed data loss and the operator’s motives remain unresolved.
Key Questions
What happened in the reported operation?
A Chinese-speaking operator used AI agents coordinated through Cairn to probe online shops. Reuters reported that the activity covered more than 1,200 sites and involved break-ins at websites of more than 100 companies.
Who was responsible?
The operator has not been identified. NorForge described the actor as Chinese-speaking, but the available reporting does not establish the person’s identity or location. No arrest or charge is reported in the source material.
Was customer or payment information stolen?
That has not been established. Reuters could not determine how much data, if any, was taken. Deere said it had no indication sensitive information was accessed; the other company statements cited do not settle what information may have been exposed across all affected sites.
What is Cairn?
Cairn is an open-source platform for coordinating AI agents. NorForge describes it as a general-purpose problem-solving system, and its author told Reuters it was not designed for hacking attacks.
How reliable is the reported $50-per-intrusion figure?
It is an estimate by NorForge researcher Snorre Fagerland, based on an estimated campaign cost of about $5,000 and the reported successful intrusions. NorForge says the cost estimate carries considerable uncertainty; it is not an independently audited figure.
Source: ThorstenMeyerAI.com
