A single attacker used a swarm of AI agents to break into more than 100 websites, with the agents operating largely on their own, according to findings from AI security firm Norforge. The victims included manufacturers John Deere, SharkNinja and Cummins, Reuters reported. The case is an early, concrete example of agentic AI being turned into an attack platform — and of how quickly the barrier to running a coordinated intrusion campaign has fallen.

How the attack was orchestrated

Norforge researchers found the campaign through exposed instances of Cairn, an open-source AI platform that bills itself as a "general-purpose problem-solving engine." Cairn lets users define a start point and an end point for AI agents, which then work toward the goal while documenting their progress. That design is useful for legitimate automation, but it also gives an attacker a ready-made orchestration layer: define the target, let the agents iterate, and review the logs as they go. Norforge identified more than 20 exposed Cairn instances it considers "likely malicious."

The most active attacker in the set targeted companies in the US, Canada, Australia and Japan. According to Reuters, the intruder specified "preferred intrusion tactics" in fewer than 100 Chinese characters, and successful breaches took roughly 23 hours. That compression matters: what once required a team of skilled operators, weeks of reconnaissance and custom tooling can now be expressed as a short prompt and executed by agents that plan, retry and document their own work.

The corporate response

The affected companies have pushed back on the scale of the exposure. A John Deere spokesperson told Reuters there is "no indication that sensitive information was accessed." SharkNinja said the breach hit a standalone site holding product support information and that it has contained the threat. Cummins spokesperson Melinda Koski said the company "is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors" — a reminder that the compromised surface was often a supplier or ancillary web property rather than a core production system.

Even so, the pattern is uncomfortable for manufacturers. Industrial firms run large, sprawling web estates — dealer portals, parts catalogues, warranty and support sites — frequently built and maintained by third parties. Those sites are exactly the kind of target an autonomous agent can probe at volume without a human deciding each step.

The platform under scrutiny

Norforge says it is working to get the malicious Cairn instances taken down. Cairn's creator, who goes by @le1xia0, said earlier this month that the platform "was never a 'hacking tool,'" adding that "misuse is a human decision, not a feature of the engine." That defense echoes the long-running debate over dual-use tooling, but the agentic twist changes the calculus: when the tool can independently sequence actions toward an objective, the distance between a general problem-solving engine and an intrusion framework narrows considerably.

Why this matters for defenders

The incident lands amid growing alarm about AI-accelerated offense. Security teams are already contending with AI-assisted phishing, vulnerability discovery and malware variation; agent swarms add persistence and parallelism. Defenders can expect higher request volumes, faster reconnaissance and attacks that adapt mid-campaign rather than following a fixed script.

The practical implications for engineering and IT leaders are direct. Exposed orchestration platforms and misconfigured agent endpoints are now part of the attack surface and should be inventoried like any other internet-facing service. Third-party web properties need the same monitoring as first-party infrastructure, since that is where several of these breaches landed. Rate limiting, anomaly detection tuned to automated traffic and strict egress controls matter more when the adversary is software that never sleeps.

Norforge's disclosure also raises a governance question for the open-source AI community: how much operational logging and abuse detection should agent frameworks ship with by default, and who is responsible when an exposed instance is repurposed. Cairn's creator frames misuse as a human choice, but the agents did the work — and at roughly 23 hours per successful breach, they did it fast.