The panels were open

This story exists because the attacker left the lights on. Snorre Fagerland, principal threat researcher at the security company NorForge, was scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform that coordinates agents against a target. From around 2 October he found about two dozen of them that he assessed as being used for malicious activity. Because the panels were exposed, he could watch the campaigns being tasked in something close to real time, and he wrote up what he saw in a report provided to Reuters ahead of publication on Monday, published by NorForge the same day as "Inside Cairn". Two limits on that vantage point are worth stating plainly: exposed is not the same as compromised — nothing in the reporting suggests Cairn itself was breached — and not every exposed instance was an attack; Fagerland also found legitimate red-team operations running on exposed panels.

The most prolific operator he found was a Chinese-speaking hacker who, from 25 September, set agents loose on e-commerce websites in the United States, Canada, Australia and Japan. What the panels showed of the human input was compact: the operator's description of his preferred intrusion tactics ran to fewer than 100 Chinese characters. Read that for what it is — evidence of a short tactic instruction, not proof that the entire campaign needed no further human input. The panels showed agents performing extended probing tasks, and the reporting suggests substantial automation, but it does not quantify how often the operator stepped in. By late last week the agents had attempted more than 1,200 sites and got into more than 100.

Read the two headline numbers carefully

The figures travelling with this story are $5,000 and $50: Fagerland's estimate of the campaign's total token spend, and that estimate divided by the reported successful compromises to give roughly $50 each. Both numbers are a researcher's reconstruction from watching open panels. Neither is a bill, and neither purports to cover the attacker's full operational costs — accounts, infrastructure and time sit outside a token estimate. They are useful as an order of magnitude — an estimated four-figure token budget alongside a three-figure breach count — and misleading as anything more precise. Token prices vary by model, the campaign appeared to mix DeepSeek and Anthropic's Claude Code, and no one has published the operator's accounts.

The 23 hours matters in the opposite direction. Fagerland estimated that a successful intrusion typically involved about 23 hours of poking and prodding. The reporting does not establish the distribution of those durations, or whether the figure is an average across all the successful compromises, so treat it as his typical case rather than a timetable every target followed. Even as a typical case, it is slow work by the standards of a focused human intruder on a single target. It is also work that costs the operator nothing in attention while it runs. Patience is the input agents supply in unlimited quantity, and patience across 1,200 targets at once is a different threat from patience against one. Fagerland, who has worked in security for nearly three decades, told Reuters he had previously assumed hacking agents would need at least some supervision. "It's a new world now," he said. In one case he described, agents that found no weakness in a company's public-facing application worked through digital records to find associated infrastructure, located a public-facing control panel, found a subtle flaw in how it processed data, and after hours of trial and error got the server to execute malicious commands. "It's not script kiddie stuff," he said.

Breached is not the same as emptied

The counterweight is in the responses. Fagerland's report did not name victims; Reuters identified them by reviewing the Cairn activity itself, which is why the three names on the record deserve to be read with their statements attached — and kept separate, because they describe different systems at different levels of certainty. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed" — a statement about what Deere has found so far, not proof that no access occurred. SharkNinja said the compromised site was a standalone property carrying only product support information, and that the threat had been contained. Cummins framed its incident as a potential attack on a website operated by one of its third-party vendors, still under investigation. Two smaller businesses acknowledged being compromised. Others listed in the data did not reply.

None of that, separately or together, establishes the campaign-wide picture on the question that matters most: Reuters could not ascertain how much data the breaches actually extracted. An uploader shell on a support site, a vendor's marketing property, and a core commerce system are all "a breached website" in a campaign count of 100-plus. They are not the same loss. So the honest shape of Monday's reporting is three numbers of very different solidity. Attempted: more than 1,200 sites. Compromised: more than 100. Extracted: unknown — and an unanswered question is not evidence that nothing was taken. A separate operator Fagerland watched did steal credit card data, on a different campaign; that is one more reason the blanket version of "no theft happened" cannot be written about this one either. What the reporting establishes is compromise at scale. What it leaves open is the loss.

Where this leaves the defence

The practical exposure is unglamorous. The targets were ordinary commercial websites, and the named cases are a reminder that exposure extends beyond the flagship storefront: one ran through a third-party vendor's site, another through a standalone support property. Those systems deserve the same asset inventory, patching and monitoring as the core commerce platform — general advice, not a claim that the named companies neglected theirs; the reporting does not establish that. Agents do not care which part of an estate is prestigious. They care which part answers. In this campaign, one operator's target selection was a list of 1,200 and the probing was automated over long stretches; a defence calibrated to a human intruder's working hours is calibrated to the wrong constraint. Cairn's author, for their part, had posted that the platform was not designed for hacking and that such use was not their intention, as quoted by Reuters — a statement that may well be true, and that changes nothing about what the exposed panels showed it doing.

Sources

  1. [1] Reuters, "Exclusive — How one hacker used AI agents and a few thousand dollars to break into scores of sites", Raphael Satter, 19 October 2026 (published 10:06 UTC, updated 13:54 UTC), via WNCY — primary wire source for all campaign facts: 1,200+ attempts, 100+ breaches, 25 September start, four countries, the under-100-character tactic instruction, the ~23-hour and ~$5,000 / ~$50 Fagerland estimates, the appeared-to-use mixture of DeepSeek and Claude Code, two dozen exposed Cairn instances from ~2 October, victim identification by Reuters' own review, all three company statements, data extraction unascertained, Cairn author's response, Fagerland quotesRead source
  2. [2] NorForge, "Inside Cairn", published 19 October 2026, as summarised by Unite.AI — the underlying investigation, accessed by ALFW through a secondary summary; ALFW did not inspect the exposed panels. 20+ publicly exposed Cairn panels assessed as likely malicious and financially motivated; panels exposed targets, weaknesses, account secrets, API keys and compromise status; NorForge redacted extracted data and is withholding panel addresses; legitimate red-team operations were also found exposedRead source
  3. [3] Oossa, "Hackers used AI agents to breach over 100 company websites", 19 October 2026 (published 14:09 UTC, updated 16:07 UTC) — independent short summary of the Reuters reporting, company responses in the same termsRead source