AI Agents Breach 100+ Firms in Mass Cyber Spree

A hacker used AI agents to breach more than 100 companies across 1,200 targets. The attacks averaged 23 hours per target. Each successful breach cost about $50 in API tokens.

Snorre Fagerland, a researcher at NorForge, discovered the campaign. Reuters first reported the findings. The attacks hit major global brands, including John Deere, SharkNinja, and a supplier for Cummins.

The hacker did almost none of the manual work. Instead, the attacker set up Cairn, an open-source AI platform built by developer “le1xia0”. The hacker linked Cairn with DeepSeek and Anthropic’s Claude Code. The AI agents scanned sites, found hidden control panels, and ran code on target servers. They worked without human help.

Technical Factsheet: The Cairn Multi-Agent Cyber Campaign

How a 100-Character Prompt Ran an Autonomous Swarm

The hacker did not spend weeks writing custom exploits or reverse-engineering firewalls. NorForge reports that the Chinese-speaking attacker started on September 25 with instructions under 100 Chinese characters.

Those short prompts gave basic goals and listed target domains. The Cairn agent framework did the rest:

• Automatic Task Splitting: Cairn broke the main goal into smaller tasks. It sent worker agents to crawl sites, inspect server responses, and flag bugs.
• Model Mixing: The setup tapped commercial model APIs. It routed tasks between Anthropic’s Claude Code and DeepSeek during each step of the attack.
• Low Compute Costs: The whole multi-week spree cost about $5,000 in API tokens across 1,200 probed targets. For the 100-plus companies breached, the cost was roughly $50 per hit.

This changes the math for cyber defense. Skills once limited to elite hacking teams now belong to lone actors with cheap API credits.

┌────────────────────────────────────────────────────────┐
│         CAIRN AUTONOMOUS MULTI-AGENT ATTACK CHAIN      │
├────────────────────────────────────────────────────────┤
│ [Operator Prompt: <100 Chinese Chars Outlining Targets]│
│            │                                           │
│            ▼                                           │
│ [Cairn Multi-Agent Coordinator]                        │
│      ├── Task Decomposition & Target Queue Management  │
│      └── API Routing: Claude Code & DeepSeek           │
│            │                                           │
│            ▼                                           │
│ [Reconnaissance Agents]                                │
│      ├── Primary Web App Probe (Firewall/WAF Active)   │
│      └── DNS, SSL & Subnet Mapping (Side-Door Pivot)   │
│            │                                           │
│            ▼                                           │
│ [Target Discovery: Exposed Administrative Portal]      │
│            │                                           │
│            ▼                                           │
│ [Fuzzing & Payload Generation Sub-Agents]              │
│      ├── Iterative Parameter Parsing Anomaly Detection │
│      └── Trial-and-Error Exploit Refinement (~23 Hours)│
│            │                                           │
│            ▼                                           │
│ [Remote Command Execution / Lateral Data Extraction]   │
└────────────────────────────────────────────────────────┘

Beyond Script Kiddies: The Multi-Step Attack Chain

Snorre Fagerland has worked in cybersecurity for nearly thirty years. He noted that the agents used real problem-solving, not basic automated scripts.

In one case, the AI agents targeted a firm whose main public web app had no open flaws. The agents did not quit. Instead, they mapped a new path into the network:

1. Mapping Outer Assets: The agents read public web records, SSL certificates, and DNS entries to find related servers.
2. Finding Hidden Panels: The swarm spotted an unindexed, public-facing control panel on a separate IP address.
3. Testing Data Inputs: The agents fuzzed the panel’s input fields. They found subtle quirks in how the backend server handled incoming data.
4. Writing Exploits on the Fly: Over hours of automated testing, the agents tweaked their payloads until they tricked the server into running remote commands.

“It’s not straightforward to come up with solutions like that. It’s not script kiddie stuff.”

Snorre Fagerland, Principal Threat Researcher at NorForge

What Victims and Developers Say

The attacks hit large manufacturers as well as smaller online retail shops:

• John Deere said it took “necessary remediation actions.” The company found “no indication that sensitive information was accessed.”
• SharkNinja stated the breach only hit an isolated site for product manuals. No customer data was stored there.
• Cummins confirmed it is looking into a potential attack on a third-party vendor site.

Other hackers used exposed Cairn setups too. Fagerland watched one attacker steal customer credit cards. Another tried to rob a crypto exchange.

Cairn’s developer goes by “le1xia0” online. They posted on X that the tool was built for multi-agent software testing, not cyberattacks. “If it is used to carry out harmful hacking attacks, that is not my intention,” they wrote.

The Surge in Agentic Cybercrime

The Cairn incident is part of a fast-growing trend across hacker groups:

• SpaceX Cursor AI Abuse (August 2026): Threat firm Gambit Security found that Russian-speaking groups used Cursor AI to breach seven companies.
• Retail Swarm Attacks (September 2026): Gambit found an AI swarm that hit 25 online stores for $25 per target. That attack took 600,000 credit card records.
• Dark Web Chatter: Cyber firm Bitsight reported that hacker forums are full of guides on how to run autonomous attack swarms.

Security teams once assumed AI agents would need constant human supervision. As Fagerland observed, real-world attackers have already moved past that limit.

How Engineering Teams Can Defend Their Stack

Traditional firewalls failed because the agents did not flood the servers. Instead, they probed quietly over 23 hours. That slow pace stayed under rate limits and alert rules.

DevOps and security teams should take three practical steps:

1. Map Your Attack Surface: Find and shut down old staging servers and forgotten subdomains. The agents found side doors, not front doors.
2. Lock Down Admin Portals: Put all control panels behind a VPN or zero-trust access. Never leave admin login pages open to the public web.
3. Track Session Behavior: Watch for IP sessions that spend hours testing inputs on rare endpoints. Track them even when total traffic stays low.

Formatting API specs, security policies, or infrastructure definitions? Validate and convert your configurations with TeckScaler’s free client-side JSON to YAML Converter.

Primary Sources: NorForge Threat Research: Inside Cairn | Reuters: How One Hacker Used AI Agents and a Few Thousand Dollars to Break into Scores of Sites