When NorForge checked an AI agentâs reported compromise at a large hardware-parts vendor, the cited URL served an uploader webshell, a foothold for placing files on the server.
That check is among the strongest evidence in NorForgeâs October 19 investigation into the malicious use of Cairn, an AI-agent orchestration platform. The security company said it found more than 20 exposed Cairn control panels likely associated with financially motivated attacks. The largest cluster contained more than 1,100 attack projects across 14 dashboards.
The wider campaign count comes from Reutersâ reporting: agents attempted to break into more than 1,200 sites and reportedly breached more than 100. Reuters identified Deere, SharkNinja and Cummins among the affected companies, while reporting different responses and levels of confirmed impact.
Behind those numbers, unsecured control panels exposed target selection, agent instructions, exploitation attempts and claimed persistence. They gave researchers an unusually detailed view of AI agents operating against real organizations.
Open Dashboards Exposed the Intrusion Workflow
Cairn is a general-purpose problem-solving engine, not exclusively a penetration-testing product. In the configuration NorForge observed, it functioned as an intrusion harness: software that coordinates agents, tools, observations and subsequent actions toward an attackerâs objective.
Each Cairn project has an origin and a goal. Workers record discoveries as âfactsâ and proposed next steps as âintents.â A shared project blackboard makes those discoveries available to other workers, and a human operator can add hints.
An unsuccessful attempt need not end the operation. Agents can retain findings, investigate another route and continue working toward the same objective. Operators can also supervise multiple projects without manually conducting every test.
NorForge found the exposed panels through internet searches using Shodan and Censys. Some instances were protected, empty or apparently legitimate. After filtering those out, the company classified more than 20 as likely malicious. It also warned that legitimate red-team operations had exposed sensitive customer information through unsecured dashboards.
The largest malicious cluster, which NorForge designated AIA0001, used Chinese-language instructions and mainly targeted organizations in the United States, Japan and Australia. Language is an observed characteristic, not proof of the operatorâs nationality. NorForge assessed the visible activity as financially motivated and reported no obvious state-sponsored operation.
The task-feeding process appeared substantially automated. One instruction described shopping sites ranked by traffic and already checked with Playwright to verify that orders could be placed. Agents then received objectives involving unauthenticated remote code execution and an uploader webshell. This suggests a pipeline for selecting commercially useful targets before spending agent time on exploitation.
A recurring domain-normalization error, which removed an initial âwâ from some target names, also helped NorForge connect related panels.
The Breach Counts Have Different Evidentiary Weight
Three measurements should stay separate: projects visible in dashboards, sites reportedly attacked and intrusions independently checked.
NorForgeâs largest cluster contained more than 1,100 attack projects. Reuters reported more than 1,200 attempted sites and more than 100 successful intrusions. These describe different units and reporting snapshots; they should not be treated as interchangeable counts.
NorForge reported validating several case-study compromises, including the live uploader webshell at the hardware-parts vendor. Those checks strengthen the finding that at least some agents achieved real access, beyond what their success messages claimed.
The researchers did not independently verify every compromise in Reutersâ wider total. An accessible webshell also does not, by itself, establish how much data was stolen, how long access lasted or whether the attacker reached other systems.
Reuters said it independently reviewed the hackerâs Cairn activity to establish victim identities. The companiesâ responses differed:
- Deere said it had taken remediation measures and had no indication that sensitive information was accessed.
- SharkNinja said the incident affected a standalone product-support site and that it had contained the threat.
- Cummins said it was investigating a potential attack on a website operated by a third-party vendor.
Those responses do not support a blanket claim that all three companies suffered equivalent breaches of their core systems. Reuters also said it could not determine the extent of unauthorized data extraction.
NorForgeâs estimated success rate of roughly 10% is an assessment derived from observed dashboards, not a controlled evaluation. Reuters reported that successful intrusions typically took around 23 hours. Neither figure establishes how a particular agent would perform against a representative sample of organizations.
DeepSeek Worker Labels Are Clues, Not Attribution
One worker name reported by NorForge was claudecode_deepseek-v4.1-flash. The label suggests a Claude Code-style harness configured to use DeepSeek, but a configuration name cannot establish the complete software stack or every model request made during an operation. It also does not establish that Anthropic or DeepSeek participated in, approved or knew about the attacks.
Reuters described the campaign as apparently using a mixture of DeepSeek and Claude Code, reflecting researcher Snorre Fagerlandâs assessment. It also reported his estimate of roughly $5,000 in token spending. No published billing record or complete accounting of the attackerâs costs accompanied that estimate.
The observed autonomy deserves similar precision. The dashboards showed agents working through extended intrusion tasks, and Fagerland told Reuters the activity changed his assessment of how much supervision such systems require. Humans still selected objectives, supplied instructions and could contribute hints. The available record does not measure every off-dashboard intervention.
Cairnâs creator disputed the characterization of the platform as a hacking tool. Reuters reported that the creator had publicly described it as a multi-agent architecture not designed for harmful attacks. That stated intent does not negate the documented misuse, but it distinguishes the platformâs purpose from an operatorâs conduct.
For the AI industry, the case concerns the combined system: models connected to browsers, security tools, shared state and persistent execution. The evidence does not isolate one model as the sole cause of the campaign.
What Defenders Can Use From the Findings
NorForge withheld panel addresses and heavily redacted target information because the interfaces exposed vulnerabilities, credentials and other sensitive material. Its public report therefore provides behavioral and operational clues rather than a complete set of deployable network indicators.
The most useful defensive actions follow the workflow the researchers observed.
Audit agent dashboards as privileged infrastructure. An orchestration interface can expose target lists, instructions, API keys, account secrets and successful access paths in one place. Organizations running authorized testing should place those interfaces behind authentication and network restrictions, then check whether logs or project artifacts were publicly accessible. NorForgeâs findings show that this risk applies to legitimate operators as well as attackers.
Investigate browser validation followed by exploitation attempts. In the observed task pipeline, Playwright checked shopping functionality before targets reached Cairn for exploitation. Browser automation alone is not malicious. A more useful investigative pattern is automated commerce validation followed by probing for authentication weaknesses, upload flaws or code execution. Defenders should correlate these activities; a browser visit alone is not a campaign identifier.
Sources
- NorForgeâs October 19 investigationnorforge.com
- Reutersâ reportingksl.com
