Why this matters: one person and autonomous software did the work of a hacking crew — and Microsoft moved the same day to treat AI agents inside companies as a security risk.
October 20, 2026 — A Chinese-speaking hacker used largely autonomous AI agents to break into more than 100 company websites, including sites linked to Deere, SharkNinja and Cummins, according to Reuters reporting on a report by cybersecurity company NorForge published on Monday.
Image: A lone operator directs streams of autonomous agents toward a wall of company website screens. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: The human barely typed, yet the agents probed more than 1,200 sites for weeks — the scarce resource in hacking is no longer skilled labour, but oversight.
Table of Contents
- How the Campaign Was Found
- How the Agents Worked
- The Numbers Behind the Campaign
- What the Companies Say
- Microsoft's Answer: Guardian Agents
- What Defenders Should Do Now
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Sites attempted | More than 1,200 |
| Sites breached | More than 100 |
| Named companies | Deere, SharkNinja, Cummins |
| Platform used | Cairn, an open-source agent platform |
| Discovery | Snorre Fagerland of NorForge, via exposed Cairn panels |
| Estimated cost | About $5,000 in tokens, roughly $50 per success |
| Time per breach | About 23 hours on average |
| Campaign start | September 25, 2026 |
How the Campaign Was Found
Snorre Fagerland, principal threat researcher at NorForge, found the campaign while searching the internet for exposed versions of Cairn.
From around October 2, Fagerland found more than 20 exposed Cairn instances that appeared likely malicious, according to NorForge. Because the panels were left open, he could watch the activity live.
Newsroom Focus: The breach was found not by monitoring victims, but by looking at the attacker's own open control panels.
How the Agents Worked
The operator's preferred tactics were described in fewer than 100 Chinese characters. The instruction called for finding a way to run code on each site, then planting an uploader web shell.
Targets were largely online shops in the United States, Canada, Australia and Japan, picked by an automated pipeline, according to reporting on NorForge's work.
The agents searched for weaknesses and kept working without close supervision. In one case, after failing on a main site, they found a connected control panel, identified a flaw, and used it to trigger malicious command execution.
"It's not straightforward to come up with solutions like that," Fagerland told Reuters. "It's not script kiddie stuff."
NorForge says the tasks ran through a worker named claudecode_deepseek-v4.1-flash, which it reads as a Claude Code harness using DeepSeek technology. That reading is NorForge's inference from the name, not a confirmed billing record.
The Numbers Behind the Campaign
The scale makes this case different: one operator ran the campaign in parallel, across many targets at once.
| Measure | Figure |
|---|---|
| Attack projects in one cluster | More than 1,100 across 14 panels |
| Success rate | Around 10% |
| Cost per attempt | About $5, including failures |
| Findings per successful project | About 140 on average |
| Longest single project | More than five days |
Those figures are Fagerland's rough estimates. NorForge warns the uncertainty is considerable, and they exclude investigation and repair costs.
Analysis Note: Cheap attempts change the maths. When an attempt costs a few dollars, a low success rate can still pay for an attacker — while every target pays for detection and repair in human time.
What the Companies Say
Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed."
SharkNinja said the incident affected a standalone site carrying only product support information, and that it has contained the threat.
Cummins said it is investigating the report of a potential cyber-attack on a website operated by one of its third-party vendors.
Reuters could not establish how much data, if any, was taken. NorForge did not name victims; Reuters identified them from the Cairn activity. Two smaller businesses also confirmed compromises.
Cairn's creator told Reuters the platform "was not designed for hacking attacks."
Microsoft's Answer: Guardian Agents
On the same Monday, Microsoft announced tools to monitor and restrict AI agents inside companies, in Microsoft 365 E7 and Project Perception, according to GeekWire.
The tools treat agents as potential insider threats, with a continuously updated risk assessment based on what data an agent can reach and whether its actions depart from its task.
When risk rises, the system can remove an agent's ability to make changes while letting it read data, require human approval for a high-stakes step, or shut it down, Microsoft says.
Microsoft is also expanding detection of agents running on employees' computers from 25 to 60 agent types, including Claude Code, OpenAI Codex and GitHub Copilot. New Guardian Agents can investigate why another agent's risk changed and recommend or take containment steps.
The features are in private preview, with broader availability planned around Ignite on November 17-19 in San Francisco, according to GeekWire. E7 costs $99 per user per month, Microsoft says.
It builds on an October 10 post by chief executive Satya Nadella arguing controls must come from outside the models themselves.
What Defenders Should Do Now
The advice is familiar but urgent: patch exposed web applications, watch for unexpected files such as web shells, and rotate leaked credentials.
NorForge says the exposed panels leaked secrets, finding hundreds of credentials and keys, with a share verified as valid.
Practical Takeaway: Treat every AI agent in your organisation like an account: give it only the access its task needs, for only as long as it needs it, and keep a way to stop it quickly.
Bottom Line
A single operator and about $5,000 in estimated token costs produced more than 100 breaches, according to NorForge and Reuters. Watch next whether data was taken, whether more victims are named, and whether Guardian-style controls become standard.
FAQ
What is Cairn?
Cairn is an open-source platform that coordinates AI agents with minimal human guidance. A user sets a start point and a goal, and the agents document their progress.
How many sites were breached?
More than 100 company websites were breached, after attempts on more than 1,200 sites, according to Reuters reporting on NorForge's findings.
Which companies were named?
Reuters identified Deere, SharkNinja and Cummins by examining the hacker's Cairn activity. NorForge's report itself did not name victims.
Was sensitive data stolen?
That is not established. Deere saw no indication sensitive information was accessed, SharkNinja said only a standalone support site was affected, and Reuters could not establish what was taken.
What did Microsoft announce?
Microsoft announced agent risk controls in Microsoft 365 E7 and Project Perception, including Guardian Agents, detection for 60 agent types, and responses from read-only access to shutdown, according to GeekWire.
Sources
- WebProNews (Reuters): https://www.webpronews.com/hacker-used-ai-agents-to-breach-john-deere-sharkninja-and-cummins-sites/
- SOFX: https://www.sofx.com/ai-agents-help-chinese-speaking-hacker-breach-more-than-100-company-websites/
- Technology.org: https://www.technology.org/2026/10/20/hacker-ai-agents-cairn-100-websites-deere-sharkninja-cummins/
- Digital Soul Hub: https://digisoulhub.com/blog/hacker-ai-agents-broke-into-100-sites/
- GeekWire: https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/
- Hero image: AI-generated illustration / Red Eye Eagle News, original illustration.
Join the conversation
Comments
Post a Comment