NorForge: a Chinese-speaking hacker’s AI agents on the open-source Cairn platform tried 1,200+ sites and breached 100+, including Deere, SharkNinja and Cummins, for about $5,000 in tokens
Partly confirmed
Importance: major (4 of 5)The takeaway
On Oct 19, 2026 NorForge researcher Snorre Fagerland published “Inside Cairn”, based on more than 20 exposed control panels of Cairn, an open-source platform that coordinates AI agents toward a goal.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- Major (4 of 5)
- Last verified
- 19 October 2026
Your AI and this story
- GPT-6 Astra172 days after its cutoff
- Claude Opus 5.5111 days after its cutoff
- Gemini 4 Argon202 days after its cutoff
- Grok 4.7141 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 111 days before it.
Key facts
- Source: NorForge blog ‘Inside Cairn: Open Windows into massive AI-Driven Cyber Operations’ (Oct 19, 2026), by principal threat researcher Snorre Fagerland; published with a Reuters exclusive by Raphael Satter
- Cairn: open-source ‘AI problem-solving’ platform; the operator sets a target and objective, agents post findings to a shared blackboard and the operator can add hints. Its author (posting as le1xia0) says it was not designed for hacking (per TNW). Not the same as Cisco Talos’s CAIRN malware-tracking toolkit
- Panels: 20+ exposed Cairn panels judged likely malicious, all apparently financially motivated, no clear sign of state sponsorship; some other exposed panels appeared to belong to legitimate red teams
- Cluster AIA0001 (Chinese-language, high confidence): 14 panels, 1,100+ projects; targets e-commerce and payment infrastructure in the US, Japan and Australia (TNW adds Canada), aiming to plant web shells; tasks ran on a worker named ‘claudecode_deepseek-v4.1-flash’ (NorForge: possibly a Claude Code harness running DeepSeek V4.1 Flash, an inference)
- Cluster AIA0002 (English-language, high confidence): 10 panels, mostly on Vultr; card and crypto theft; workers named ‘pi_openrouter_deepseek’ (Pi agent framework calling DeepSeek via OpenRouter). AIA0003: 1 panel, 59 projects, low confidence
- Performance (NorForge): ~10% average success rate; successful AIA0001 projects took a little under 23 hours on average with ~140 facts per project; cost ~$5 per task including failures, $100+ for very large projects; NorForge calls the uncertainty considerable
- Scale (Reuters, via TNW and press): agents tried 1,200+ sites in the US, Canada, Australia and Japan from Sept 25; 100+ entities breached; Fagerland’s rough estimate ~$5,000 in tokens, about $50 per successful hack; NorForge itself confirmed one claimed break-in (a large hardware-parts vendor, web shell live)
- Victims named by Reuters (not independently verified by TNW): Deere took remediation steps and saw no sign sensitive data was accessed; SharkNinja said a standalone product-support site was hit and contained; Cummins is investigating a possible attack on a vendor-run website. Reuters could not determine what data, if any, was taken
Show 2 more
- The panels exposed hundreds of credentials and API keys (TruffleHog verified 11% as valid); NorForge and Reuters are notifying victims and asking hosts to take the panels down; NorForge reports no response from Anthropic or DeepSeek
- Context cited by TNW: Gambit Security reported in September that AI agents (Cairn among the tools) stole at least 600,000 card records from 25 companies; Taiwan’s government and India’s CERT-In have also reported agent-assisted intrusions
What happened
NorForge, a security research firm, found more than 20 Cairn control panels left open on the internet and read the projects, findings and logs inside them. Cairn is an open-source platform in which AI agents work step by step toward a goal set by an operator. In the largest cluster, a Chinese-speaking operator pointed agents at online shops and payment systems with the goal of planting web shells for lasting access, and the agents worked through each target step by step. Reuters, working with NorForge, identified Deere, SharkNinja and Cummins among the victims and published the story on Oct 19.
The Reuters article was not readable to us; its figures (1,200+ sites, 100+ breaches, ~$5,000) come from TNW’s and other outlets’ summaries of it. NorForge’s own report gives per-task costs and success rates and stresses that they are rough. The model behind the largest cluster is inferred from a worker label (“claudecode_deepseek-v4.1-flash”), not confirmed.
Why it matters
It is one of the first documented criminal campaigns in which a single operator ran a large hacking operation mostly through autonomous agents, using a cheap open-weight model, at a cost of tens of dollars per successful intrusion. Unlike the lab-evaluation incidents of 2026, these were deliberate attacks on companies that never consented to testing.
Sources
4 sources from 4 sites. Numbers match the chips in the text.
4 sources: 1 primary, 3 press
Primary
- NorForge: Inside Cairn, open windows into massive AI-driven cyber operations (Oct 19)norforge.com, official
Press
- Reuters: How one hacker used AI agents and a few thousand dollars to break into scores of sites (Oct 19; blocked for us, read via syndication summaries)reuters.com, press
- TNW: AI agents broke into 100+ sites for one hacker at $50 each, researcher saysthenextweb.com, press
- The Verge: A hacker broke into John Deere and SharkNinja with an army of AI agents (not readable to us)theverge.com, press
Changes
- Filed