AI Agents Were Used to Break Into More Than 100 Sites, Security Researchers Say

A hacker used an army of AI agents to break into more than 100 websites, according to new findings from the security firm Norforge. The attacks mattered because they suggest automated AI systems are now capable of carrying out much of the intrusion process with only limited human direction, raising the stakes for businesses already struggling to defend against AI-driven threats.

Reuters reported that some of the affected organizations included John Deere, SharkNinja, and Cummins. Norforge says the campaign appears to have crossed borders as well, hitting targets in the United States, Canada, Australia, and Japan.

What Norforge found

Norforge said it uncovered the activity by examining exposed work linked to Cairn, an open-source AI platform that describes itself as a general-purpose problem-solving engine. The platform is designed so a user defines the starting point and desired outcome, while AI agents handle the intermediate steps and document progress along the way.

In legitimate settings, that kind of setup can help teams automate research, analysis, and repetitive workflows. But Norforge says the same architecture can also be used to coordinate cyber intrusions, giving attackers a way to chain together reconnaissance, login attempts, and other steps at scale.

The company said it identified more than 20 exposed Cairn instances that were likely malicious, and one stood out as especially active. That instance was responsible for the campaign that reached more than 100 sites, the researchers said.

How the attack appears to have worked

Norforge’s description points to a new kind of low-touch hacking operation. Instead of a human manually running every step, the AI agents appear to have handled most of the operational work on their own.

Reuters reported that the attacker used fewer than 100 Chinese characters to outline preferred intrusion tactics, after which the agents carried out the work. Successful breaches reportedly took about 23 hours, indicating a process that was highly automated but still guided by a human operator at the top.

That balance is the key reason security analysts are paying attention. It suggests that once a malicious workflow is built, an attacker may be able to scale it across many targets with far less effort than traditional hands-on hacking.

Why this matters for security teams

The episode adds to a growing body of evidence that AI is speeding up offensive cyber activity. As the technology becomes better at planning, writing, and adapting, the line between a scripted attack and an autonomous campaign gets thinner.

For defenders, that creates several problems at once:

• Attacks can move faster than human analysts can respond.
• One operator may be able to run many attempts in parallel.
• Malicious activity may be harder to distinguish from legitimate automation.
• Exposed AI platforms themselves can become part of the attack surface.

Which companies were affected?

Norforge did not publicly name the targets in its initial write-up, but Reuters identified several of the victims as large industrial and consumer brands. John Deere, SharkNinja, and Cummins were among those reported to have been affected.

The incidents did not all look the same. A John Deere spokesperson told Reuters there was no indication that sensitive information had been accessed. Cummins said it was investigating a report involving a potential cyberattack on a website run by one of its third-party vendors. SharkNinja said the breach touched a standalone support site and that it had contained the threat.

What is Cairn and why is it important?

Cairn is an open-source platform built around AI agents that can carry out complex tasks in sequence. In its own framing, it is a problem-solving engine meant to take a destination and figure out the path there.

That model is attractive because it can reduce the amount of manual work needed for legitimate automation. But it also creates a blueprint that attackers can exploit. If a platform can be used to break a job into steps, document progress, and iterate on the fly, it can just as easily be adapted for abuse.

Norforge said it found exposed Cairn instances that were likely malicious and is now trying to have them taken down. That detail matters because it suggests the threat is not theoretical: attackers may already be using real-world AI tooling, not just custom code, to conduct operations at scale.

Why AI-powered attacks are becoming a bigger problem

AI security researchers and defenders have been warning that malicious use of generative systems could dramatically lower the barriers to cybercrime. This case offers a concrete example of what that future may look like.

Traditional hacking often requires time, patience, and a certain level of operator skill. AI agents can compress those requirements by handling repetitive tasks, exploring options, and adjusting as the campaign proceeds. Even if a human remains in control, the human can now supervise a fleet rather than micromanage each move.

That shift matters for both corporate and public-sector security. More automation means more volume, and more volume means more chances that a weakly protected website, vendor portal, or support system will be found and exploited.

How defenders may respond

Security teams are likely to focus on a few immediate countermeasures. These include tightening access to AI workflow tools, monitoring for unusual patterns of agent behavior, and limiting exposure of systems that can be chained into multi-step attacks.

1. Review which AI agent platforms are publicly exposed.
2. Audit vendor-facing and support-facing web properties.
3. Look for signs of automated, high-volume login or probing activity.
4. Restrict AI orchestration tools to approved environments.
5. Prepare incident response plans that account for faster attack cycles.

How the platform’s creator responded

The creator of Cairn, who goes by the handle @le1xia0, said earlier this month that the platform was never intended to be a hacking tool. The creator argued that misuse is a human choice rather than a feature of the software itself.

“Misuse is a human decision, not a feature of the engine,” the creator said earlier this month, while insisting the platform was not built for hacking.

That response reflects a debate that is becoming familiar across the AI industry. Toolmakers often argue that general-purpose systems cannot be blamed for how people use them, while security researchers counter that design choices can meaningfully shape how easy abuse becomes.

In practical terms, the question is not whether software can be misused — almost any software can. The larger issue is whether an AI platform can drastically increase the speed, scale, and sophistication of abuse once it falls into the wrong hands.

What this incident says about the future of cybercrime

This case is important because it shows the transition from AI-assisted hacking to semi-autonomous attack campaigns. The distinction matters. An AI chatbot that helps write phishing messages is dangerous, but an AI agent system that can execute a multi-stage intrusion with minimal oversight is more alarming.

As AI models become more capable, the cybersecurity community is likely to see three broad changes:

• Faster campaigns: attackers can move from idea to execution more quickly.
• Broader reach: a single operator can target more victims at once.
• Harder attribution: autonomous tools can blur the line between scripts, bots, and human decision-making.

That does not mean every AI agent is a threat. It does mean that organizations can no longer treat agentic automation as a niche experiment. If a tool is powerful enough to coordinate complex work, it is powerful enough to be redirected toward harmful goals.

Timeline of the reported attack

The publicly reported details point to a fast-moving incident that unfolded over several stages, from exposure to investigation to response.

What happens next?

For now, Norforge says its priority is to get the malicious Cairn instances taken down. For the companies named in reporting, the focus is likely to remain on containment, vendor review, and determining whether the attacks touched any internal systems or data.

The broader lesson is likely to resonate across the security industry. As AI agents move from demos to real operational use, they are becoming a new lever for both productivity and abuse. The same systems that can automate research or software workflows can also be weaponized into high-throughput intrusion engines.

That tension is now central to the next phase of cybersecurity. The question is no longer whether attackers will use AI agents. This incident suggests some already are.