A Chinese-speaking operator delegated nearly all offensive work to AI agents: instructions under 100 characters and hours of autonomous trial and error. According to Reuters and the firm NorForge, more than 100 company sites fell in a couple of weeks. The most uncomfortable part for defenders is that the barrier is no longer skill, but about US$50 in tokens.
NorForge researcher Snorre Fagerland was hunting for exposed instances of Cairn, an open-source, AI-agent problem-solving platform that has become popular with attackers. Starting around October 2, he found nearly two dozen instances being used for malicious purposes. Reuters, which broke the story as an exclusive on October 19, identified victims by reviewing the attacker's activity; NorForge's report does not name them.
Affected companies Reuters was able to identify include Deere, SharkNinja and Cummins. Deere said it took "necessary remediation actions" and that there is no sign sensitive information was accessed; SharkNinja said only a standalone product-support site was affected; Cummins is investigating a possible attack on a site run by a third-party vendor. Reuters could not establish how much data, if any, was taken, and The Next Web notes it did not independently verify the intrusions.
The operator hands over a target and a goal; the agents proceed step by step and post findings to a shared board that other agents (and the operator) can read and add hints to. In the Chinese-language cluster, NorForge counted more than 1,100 projects across 14 dashboards, aimed at planting a web shell on online stores to get persistent access to their payment systems. Another cluster, in English, had 10 dashboards focused on stealing cards and cryptocurrency.
In one case Reuters described, the agents found no flaws in a large company's public-facing application, so they mapped the related infrastructure, found an exposed control panel, and exploited a subtle data-processing flaw until the server executed commands. Fagerland called it sophisticated, "not script kiddie stuff," and said he had assumed offensive agents would need human supervision; this case suggests they no longer do.
We have visibility into this because many operators left their Cairn dashboards open to the internet, where NorForge found them with scanning tools. The data in those dashboards included hundreds of credentials and API keys; according to TNW, the Trufflehog tool verified around 11% as valid. Cairn's author (alias le1xia0) replied on X that it is a multi-agent architecture not designed for hacking and that harmful use is not the intent. NorForge is working with Reuters to notify victims and is asking hosting providers to take the dashboards down.
Reuters says the campaign appears to combine DeepSeek models with Anthropic's Claude Code, but presents this as Fagerland's assessment. TNW adds that jobs ran on a worker named "claudecode_deepseek-v4.1-flash," which could mean Claude Code running on DeepSeek's cheap model. That is an inference from a name, not a confirmation from either provider; treat it accordingly.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel