Hacker Deploys AI Agent Army Against 100 Websites

Hacker uses AI agents to compromise 100+ websites

A single hacker managed to compromise over a hundred websites using a fleet of AI agents that ran with barely any human hand-holding, according to research Norforge dropped on October 19, 2026. Norforge kept the victim list close to the vest in their own write-up, but Reuters dug it up: John Deere, SharkNinja, and Cummins were in the crosshairs. It’s honestly one of the clearest proofs yet that autonomous AI isn't just a lab experiment anymore; it’s being weaponized for industrial-scale intrusion.

Norforge discovers campaign via exposed Cairn instances

Norforge stumbled onto the campaign by scanning for exposed instances of Cairn, an open-source platform billing itself as a general-purpose problem-solving engine. The way Cairn works, you feed it a starting point and a finish line, and the agents figure out the messy middle, logging every step. That flexibility is a double-edged sword, though. A bad actor can just point the thing at a target, say "get in," and let the agents reverse-engineer the exploit chain on their own.

The operator behind this wave was the busiest of the exposed Cairn instances Norforge looked at. The hits landed on orgs in the US, Canada, Australia, and Japan. Reuters says the hacker encoded their preferred intrusion tactics in fewer than a hundred Chinese characters, and each successful breach took about twenty-three hours, soup to nuts. Norforge flagged over twenty Cairn deployments that look malicious, a pretty strong signal this technique is spreading past a lone wolf.

Company reactions mixed to AI-driven hacking campaign

Company reactions have been all over the map. A John Deere rep told Reuters there’s no sign sensitive data was touched. Cummins said they’re investigating a potential hit on a site run by a third-party vendor. SharkNinja claimed the intrusion only hit a standalone product-support portal and that they’ve contained the threat. None of the three got back to requests for further comment right away.

Norforge says they’re working to get the malicious Cairn instances yanked offline. The platform's creator, @le1xia0, posted earlier this month insisting Cairn was never meant to be a hacking tool and that misuse is a human choice, not a feature. That’s probably cold comfort for security teams now staring down adversaries who can spin up dozens of tireless agents to probe for holes 24/7.

AI threat model shifting for system builders and defenders

For anyone building or deploying AI systems, this whole episode screams that the threat model is shifting fast. Autonomous agents that can plan, execute, and pivot without a human babysitting every step aren't theoretical-they're live in production attacks right now. Open-source frameworks built for legit automation can be repurposed with almost zero effort. The barrier to entry for sophisticated, high-volume intrusion has effectively evaporated.

Outfits running public-facing web assets should treat this as a wake-up call to audit their exposure to AI-driven recon and exploitation. That means taking stock of any agent platforms-commercial or open-source-touching your infrastructure, watching for weird, agent-like traffic patterns, and making sure third-party vendors are held to the same standard. Devs maintaining these frameworks really ought to bake in guardrails: rate limiting, target allow-lists, audit logging the operator can’t just switch off.

The bigger picture? The line between a handy automation tool and an attack platform comes down to nothing but intent. As agent capabilities grow, defenders have to move past signature-based defenses and toward behavioral detection that spots the hallmarks of autonomous probing-rapid, iterative, unburdened by human speed limits. The script kiddie era is fading; the agent swarm era is here. If you're waiting for verified exploits to show up in threat feeds, you're already behind the curve.

Source: The Verge