Headline

Hacker Breached John Deere and SharkNinja With AI Agent Army

Key Facts

• A hacker breached more than 100 websites using an army of AI agents that mostly operated on their own, according to the AI security firm Norforge.
• The affected organizations included John Deere, SharkNinja, and Cummins, though Norforge did not publicly name the targets in its findings.
• The attacks were linked to exposed instances of Cairn, an open-source AI platform that describes itself as a general-purpose problem-solving engine.
• Cairn lets users define a start point and an end point for AI agents, which then document their progress as they complete tasks; the same structure can be used to orchestrate cyberattacks.
• The most active attacker targeted companies in the United States, Canada, Australia, and Japan and laid out preferred intrusion tactics in fewer than 100 Chinese characters.
• Successful breaches took about 23 hours, and Norforge found more than 20 exposed Cairn instances that were likely malicious.
• John Deere said there was no indication that sensitive information was accessed; SharkNinja said the breach affected a standalone product-support site and that the threat was contained.
• Cummins said it was investigating a report of a potential cyberattack on a website operated by a third-party vendor.
• Norforge said it was working to get the malicious Cairn instances taken down, while Cairn's creator rejected the idea that the platform was a hacking tool.

An AI-Driven Breach Campaign

The campaign represents one of the clearest examples yet of how autonomous software agents can be turned into an attack workforce. Instead of manually probing one target at a time, the operator appears to have set high-level goals and allowed the agents to plan, execute, and document steps toward a breach. That division of labor lowers the amount of direct human involvement needed at each stage, even if a person remains responsible for configuring the system and choosing the targets.

Norforge discovered the activity while examining exposed deployments of Cairn, an open-source platform that presents itself as a general-purpose problem-solving engine. Cairn is designed to let users define a starting point and a desired end point; AI agents then work through intermediate steps and record their progress. That design is useful for legitimate automation, but it also creates a ready-made command structure for offensive operations when the platform is left accessible and unsecured.

Exposed Instances and Reusable Tactics

Exposed instances are important because they can reveal not only the platform but also the instructions and workflows behind an operation. In this case, the most active attacker stood out among the exposed Cairn deployments. The intruder targeted organizations in the United States, Canada, Australia, and Japan. The attacker described preferred intrusion tactics in fewer than 100 Chinese characters, a compact set of instructions that could be reused across many targets. Successful breaches took roughly 23 hours, suggesting that the agents could sustain a campaign over a full day while the human operator monitored or adjusted the approach.

Norforge found more than 20 exposed Cairn instances that it considered likely malicious. That figure matters because it suggests the problem is not a single isolated experiment. Multiple deployments may have been configured for offensive use, and each one could support a different set of targets, tactics, or automation goals. The security firm said it was working to get the malicious instances taken down, but takedown efforts can be complicated when a platform is open source and can be copied, rehosted, or reconfigured quickly.

Victims and Corporate Responses

John Deere, SharkNinja, and Cummins were among the victims identified in connection with the campaign. John Deere said there was no indication that sensitive information was accessed. SharkNinja said the breach affected a standalone site that carried product support information and that the company had contained the threat. Cummins said it was investigating a report of a potential cyberattack on a website operated by one of its third-party vendors. The responses point to a familiar pattern in modern breaches: the initial entry point may sit with a vendor, a support portal, or an ancillary site rather than a core corporate network. Even when sensitive data is not exposed, such incidents can create operational disruption, reputational risk, and a need for costly forensic review.

How AI Agents Change the Tempo

AI agents are not magic, and they do not remove the need for vulnerability discovery, credential access, or persistence. What they change is speed and scale. An agent can be assigned a goal, allowed to use tools, and left to iterate through steps while recording what worked. When many agents run in parallel, the operator can test multiple entry points, product lines, or subsidiaries at once. The approach can also make attacks more adaptable, because agents can adjust tactics based on responses from a target. That combination of automation and iteration is what makes the campaign significant. It turns a process that once required a team into something closer to a managed workflow, with the human operator setting direction rather than carrying out every action.

The use of Cairn also raises questions about how open-source AI tools are governed. A platform can be built for general problem solving and still be repurposed for harmful tasks. The creator of Cairn rejected the characterization of the platform as a hacking tool, saying that misuse is a human decision rather than a feature of the engine. That argument is technically reasonable: general-purpose systems can be used for many purposes, and the responsibility for abuse lies with the operator. But security teams still face a practical problem. When a tool is open source, widely available, and capable of orchestrating multi-step tasks, malicious deployments can appear faster than platforms can police them.

A Broader Cybersecurity Shift

The incident also fits into a broader shift in cybersecurity. Security researchers have warned for years that AI could lower the barrier to entry for less skilled attackers by automating reconnaissance, social engineering, and exploit selection. More recently, the concern has expanded to agents that can act with limited supervision. An agent that can browse, call tools, and remember prior steps may be able to carry out a campaign that would previously have required a human at every stage. That does not mean every attacker can build such a system, but it does mean that the gap between a skilled operator and a moderately skilled one may narrow.

For defenders, the lesson is not that AI agents are unbeatable. It is that the attack surface is expanding. Exposed development tools, misconfigured platforms, third-party vendor sites, and forgotten support portals can all become entry points. Defenders need to inventory internet-facing systems, monitor for unusual automated behavior, and treat AI orchestration platforms as sensitive infrastructure. The same systems that help teams solve complex problems can help adversaries coordinate complex attacks if they are left open. The fact that the campaign involved more than 100 websites shows how quickly a single exposed setup can scale.

Infrastructure Visibility and Attribution

Norforge's findings also underline the value of watching the infrastructure around an attack, not just the attack itself. The exposed Cairn instances provided a window into how the operation was organized. Researchers could see the goals, the progression, and the reuse of tactics. That kind of visibility is valuable because it can help defenders identify patterns before every victim is known. It can also help platforms and hosting providers respond faster when an instance is being used for abuse.

The victims have not reported a common set of technical indicators, and the public account leaves many questions open. It is not clear how many of the more than 100 websites were successfully compromised versus probed, how much data was accessed, or whether the attacker had a financial or strategic motive. The affected companies have given limited statements, and investigations are likely to continue. What is clear is that the campaign combined an accessible AI platform, exposed infrastructure, and a high degree of automation. Those ingredients are not exotic. They are increasingly common.

Platform Responsibility and Misuse

Cairn's creator has argued that the platform was never a hacking tool and that misuse is a human decision. That debate is likely to continue as general-purpose AI systems become more capable. Platforms can add safeguards, logging, and rate limits, but open-source software can be modified. Law enforcement and regulators can pursue malicious operators, but attribution and jurisdiction are difficult. The practical result is that defenders cannot assume a tool will be used only for its intended purpose. They must plan for misuse and build monitoring around systems that can plan and act on their own.

Norforge said it is working to get the malicious Cairn instances taken down. The effort is important, but it is also a reminder that takedowns are a response, not a permanent fix. As long as the underlying model and platform remain available, new instances can be created. The campaign against John Deere, SharkNinja, Cummins, and more than 100 other websites is therefore a warning about the operational tempo of AI-enabled attacks. The human hacker did not need to carry out every step. The agents did much of the work, and the infrastructure made that work visible to researchers who knew where to look.

Source:The Verge News