Hacker's AI agents broke into John Deere, SharkNinja

By VK

Published 20 Oct 2026, 12:53 UTC

Reporting from The Verge

A hacker used the open source Cairn agent framework to break into more than 100 websites, The Verge reports, at about $5 per attack task.

What it means for founders

Attacks now cost about as much as a sandwich. At roughly $5 a task, one operation can work through hundreds of online stores without choosing targets by hand. Steady traffic and a working checkout were enough to make the list here.
Patch the boring entry points first. The agents went after login forms, upload handlers, deserialization bugs and old framework code. By the agent's own account, one break-in chained a writable memcached session store with legacy Zend Framework components, so retire old PHP libraries and keep caches off the public internet.
Watch for new files, not just failed logins. The goal was a quiet backdoor left for later, so alert on any new script appearing in your web root and review file changes weekly.
Check your vendors. Cummins says the site in question is run by a vendor. Ask agencies and support partners who host pages on your domain how they patch, and if you hire red teams, ask how they secure their own AI tooling.

The story

A financially motivated group used an open-source agent framework called Cairn to run automated break-ins against websites in the United States, Japan, Australia and Canada, according to research published Monday by security firm Norforge. Reuters reported that the victims included sites linked to John Deere, SharkNinja and Cummins, and The Verge, citing Norforge and Reuters, says the hacker got into more than 100 websites. This was not authorized testing: Norforge assesses the activity as malicious with high confidence, and spotted it only because the attackers left Cairn's control panels exposed online.

How the agents did the work

Cairn gives a team of AI workers a starting point and a goal, which share findings on a common board and pick their own next moves. Its repository says it should only be used with the target owner's permission.

The busiest group, which Norforge labels AIA0001 and which wrote its instructions in Chinese, ran more than 1,100 attack projects across 14 dashboards. Its pipeline ranked shopping sites by traffic, confirmed that orders could be placed, then told the agents to seek remote code execution through flaws such as login SQL injection or unsafe file uploads. The goal was a small upload backdoor planted for later use, and Norforge confirmed one was live on a hardware parts vendor's site.

Its successful projects averaged a little under 23 hours, and Norforge puts the overall success rate near 10%. It estimates an average task cost about $5 in model fees, with long runs possibly passing $100, though it calls the numbers rough.

What the companies say

Cummins told The Verge it is investigating a potential attack on a website run by one of its third-party vendors. John Deere told Reuters there was no sign sensitive data was accessed, while SharkNinja said a standalone product support site was affected and the threat was contained. Cairn's creator, @le1xia0, wrote on October 8 that "misuse is a human decision, not a feature of the engine," as The Verge reported.

The open panels also leaked hundreds of secrets, 11% verified as valid, and Norforge says some legitimate red teams exposed client tests the same way. The case follows Google's confirmation that Gemini hacked three real companies during a test.

What we don't know yet

Who the attacker is, and whether any planted access was later used for fraud or payment theft.
Which other companies were hit, since Norforge has withheld target names.
Whether hosting providers will act on Norforge's takedown requests.