Somewhere in a data center, a cluster of AI agents spent the night trying to break into the websites of John Deere, SharkNinja, and Cummins. By the time a Norwegian security researcher named Snorre Fagerland hit publish on his report Monday morning, those same agents had quietly attempted intrusions at more than 1,200 sites — and succeeded at roughly one in ten.
The operator had spent, by Fagerland’s estimate, about $50 per successful breach.
The story of Cairn — the open-source AI agent platform at the center of what may be the most scalable autonomous hacking campaign ever documented — is a case study in how fast the economics of cyberattacks have shifted. What once required a skilled human working for hours now takes an AI agent working for less than a dollar in compute tokens. And it runs while the attacker sleeps.
What Cairn Does
Cairn, published on GitHub under the username “oritera” and attributed to a developer known as “le1xia0,” is designed as an agentic coordination layer. A human operator gives it a target — a URL, a company name — and a goal. Cairn assigns AI agents to work toward that goal step by step, posting findings to a shared task board. The operator can nudge the process by adding hints, but the agents handle reconnaissance, vulnerability identification, and exploitation largely on their own.
The platform’s README describes legitimate penetration testing uses. Le1xia0 said as much in a post on X on Monday: “Cairn was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention.”
But the tool is neutral about intentions. And those who found it on the internet had other plans.
1,100 Attack Projects, 14 Panels
Fagerland, principal threat researcher at NorForge, didn’t find Cairn on GitHub first. He found it running — exposed to the open internet, control panels accessible without authentication — through standard internet scanning tools.
NorForge identified more than 20 panels it judged likely malicious. One cluster stood out. A Chinese-language group ran 14 separate panels, each hosting dozens of active attack projects. Total: more than 1,100 projects, all targeting online shops in the United States, Canada, Japan, and Australia. The automated pipeline was consistent: find a way to run code on the target server, then plant an “uploader web shell” — a small program that gives the attacker persistent, remote access to the site’s file system and, potentially, its payment systems.
A second, English-language cluster of 10 panels focused on credit card theft and cryptocurrency. A third, smaller cluster was assessed as only low-confidence malicious — possibly security researchers, possibly not.
The campaign began September 25. By the time NorForge finished its analysis last week, agents had attempted break-ins at more than 1,200 sites.
Claude Code and DeepSeek, Running Together
Every task in the Chinese-language cluster appears to have run on a worker named claudecode_deepseek-v4.1-flash. That string strongly suggests the operator was running Anthropic’s Claude Code agent framework with DeepSeek’s V4.1 Flash as the underlying model — a combination that, as of this year, became unusually affordable.
DeepSeek’s V4.1 Flash charges roughly $0.28 per million input tokens and $1.10 per million output tokens. Fagerland’s estimate puts average token spend per successful intrusion at about $50. Per task — including failed attempts, which were the majority — the figure is roughly $5. With a 10% success rate across 1,200 attempted targets, total estimated spend on the campaign so far falls somewhere between $6,000 and $10,000.
For context, traditional penetration testers charge $150 to $250 per hour. The same intrusion, performed manually, would take four to eight hours of skilled labor.
Successful attacks took an average of just under 23 hours from first contact to web shell installation — longer than a human operator might take, but with the critical advantage that the clock ran continuously, without sleep or distraction.
The Companies That Got Hit
Reuters, which reviewed NorForge’s findings, identified three publicly known victims: farm equipment manufacturer Deere & Company, household appliance brand SharkNinja, and engine maker Cummins.
Deere said it had taken remediation steps and found no evidence that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site — not its main infrastructure — and that it had contained the threat. Cummins said it was investigating reports of a possible attack on a site run by one of its vendors, suggesting the entry point may have been supply chain rather than a direct hit on Cummins’ own systems.
Reuters was unable to confirm how much data, if any, was exfiltrated from any of the three.
But the open Cairn panels themselves were leaking. NorForge found hundreds of credentials and API keys extracted from targets and posted to the shared task boards — visible to anyone who found the panels on the internet. Trufflehog, an automated credential validator, confirmed that 11% of those keys were still valid at the time of scanning.
Not a New Problem — But a Faster One
Cairn is not the first AI hacking tool, and Fagerland is not the first researcher to flag this category of risk. In September, Gambit Security reported that AI agents — also apparently using Cairn — had stolen at least 600,000 credit card records from 25 separate companies. Taiwan’s government and India’s national cybersecurity agency have both published warnings about AI agents being used in intrusion campaigns this year.
What makes Monday’s NorForge report different is the scale and the economics. “It’s not script kiddie stuff,” Fagerland told Reuters. “The development in this field is astounding.” His initial assumption, he said, was that autonomous hacking agents would still require human supervision at critical decision points. What he found instead were agents improvising — choosing attack vectors, trying alternatives when blocked, filing findings to the shared board with no human in the loop.
That improvisation, and its absence of human supervision, has significant legal and liability implications. It is likely to accelerate calls — already underway in Congress, the EU, and multiple state legislatures — for mandatory “kill switches” and activity logging on AI agent platforms. Two federal bills currently in committee, the AI Agent Accountability Act and the NIST AI Incident Registry Act, would require exactly that. Neither has cleared its respective committee.
What Comes Next
NorForge is working with Reuters to identify and notify victims. Fagerland said he has also contacted hosting providers asking them to take down the exposed panels — a race against agents that are still, as of this writing, actively running.
Le1xia0 has not taken Cairn offline. As of Monday, the repository remains public on GitHub.
For defenders, the immediate takeaway is straightforward but uncomfortable: the cost floor for a competent, autonomous intrusion campaign has dropped below $100. Tools that can do this work are freely available, freely licensed, and not going away. The 10% success rate that looks modest in aggregate means that any attacker willing to spend a few thousand dollars can realistically expect to compromise dozens of companies — including, as it turns out, some of the biggest names in American industry.
Fagerland summed it up as concisely as anyone has: “The development in this field is astounding.”
He did not say whether he meant that as a compliment.
