TL;DR: Norforge reported that AI agents (AI systems that accept tasks and execute them step by step) were used to attack more than 100 websites, with minimal human involvement. The incident highlights the risks of general-purpose tools being misused and the need to inspect third-party service providers’ websites.
This attack demonstrates that AI agents can work together to breach more than 100 websites, with only limited hacker involvement. Users defined the starting and ending points through Cairn, then let the agents carry out the work independently.
Norforge found more than 20 Cairn instances that were likely malicious. The named companies responded differently: John Deere said it had found no signs that sensitive data had been accessed, SharkNinja said it had contained the threat, and Cummins is investigating the incident.
When Company Websites Are Attacked With Almost No Human Oversight
Norforge reported that hackers used AI agents to breach more than 100 websites, with minimal human involvement. The successful attacks took approximately 23 hours, and the hackers specified their “preferred intrusion tactics” in fewer than 100 Chinese characters.
This reflects the risks of AI agents that receive a target and continue working independently—from sequencing tasks to attacking websites in the United States, Canada, Australia, and Japan.
The Problem Isn’t Just That AI Has Become More Capable
Organizations must determine whether an incident occurred on their own websites or on the websites of external service providers. In Cummins’ case, the company is investigating an attack that may have occurred on a vendor’s website.
John Deere said there were no signs that sensitive data had been accessed, while SharkNinja said the incident affected a separate product-support information website and that the threat had been contained. The difficult part, therefore, is not simply that AI has become better at attacking, but gaining visibility into risks across the entire website supply chain.
Where Cairn Fits Into the Story
Cairn is an open-source AI platform (software that is open to inspection and further development) that describes itself as a “general-purpose problem-solving tool.” Users define the starting and ending points for agents, and the system records their progress while they work.
However, Norforge reported that Cairn may be used to coordinate cyberattacks. The key issue, then, lies in how the tool is used—not merely in the features its creators originally intended it to have.
Compared with large enterprise platforms, Cairn still appears to be a smaller, flexible tool that can be used in many ways. I recommend viewing it like a multipurpose tool: the tool itself may not have malicious intent, but the outcome depends on who holds it and how they use it.
The source contains no information about earlier or newer versions of Cairn, or its development history. We therefore cannot conclude how the tool has changed over time, and should not create an old-versus-new comparison table.
| Factor | Cairn as a general-purpose tool | Cairn used for attacks |
|---|---|---|
| Role | General-purpose problem-solving tool | Used to coordinate cyberattacks |
| Task definition | User defines the starting and ending points | Attacker defines the intrusion strategy |
| Reported outcome | Records progress while working | Breached more than 100 websites |
From a Command of Fewer Than 100 Characters to a 23-Hour Breach
Users defined the starting and ending points for the AI agents, then let them carry out the mission independently while recording their progress along the way. This made it possible to track attacks that continued over time.
The attackers specified their “preferred intrusion method” in fewer than 100 Chinese characters. The system then carried out attacks against various websites, taking approximately 23 hours per successful attack.
The attacks affected companies in the United States, Canada, Australia, and Japan. The concerning point is that the people issuing the commands were involved relatively little, while the AI agents handled the main work themselves.
No Competitor List Appears in the Report
The source provides no information about competing tools or other platforms, so it would be inappropriate to rank them or compare their performance with any product.
| Factor | Norforge | Cairn | Attackers |
|---|---|---|---|
| Role | Detected and analyzed the attacks | Open-source AI platform | Used AI agents to conduct attacks |
| Function in the incident | Disclosed suspicious Cairn instances | Allowed users to define starting points and destinations | Defined the preferred intrusion method |
| Status | AI security company | Tool misused for unintended purposes | Attack operators |
The Attack’s Strengths and Its Visible Limitations
The AI agents operated according to defined starting points and destinations, with minimal human involvement, allowing the attacks to scale across a large number of websites.
Pros
- +Operated according to defined objectives
- +Conducted attacks at scale with minimal human involvement
Cons
- −Some Cairn instances were exposed and detected by Norforge
- −The impact varied across websites, and efforts were made to remove malicious instances from systems
Costs the News Report Has Not Disclosed
The report confirmed that Cummins is investigating an incident that may have affected an external service provider’s website. SharkNinja said it had contained the threat on its product-support information website. The burden therefore lies in investigating and containing the incident, as well as auditing the systems of external service providers.
However, the report contains no figures for the costs or time involved in these processes. It also does not disclose total losses, ransom demands, or evidence of a data breach. John Deere likewise said there were no signs that sensitive data had been accessed.
Who Should Pay Particular Attention to This Incident
Website administrators and cybersecurity teams should follow this story because Norforge found more than 20 publicly exposed Cairn instances, and AI agents were used to attack more than 100 websites.
Organizations that rely on third-party service providers’ websites are also directly affected. Cummins said it is investigating a third-party vendor’s website, while SharkNinja said the incident occurred on a separate website for product-support information.