From AI Assistance to Delegated Intrusions
Recent reporting offers a detailed view of criminals delegating substantial parts of web intrusions to AI agents. In an investigation published on October 19, 2026, NorForge researcher Snorre Fagerland described more than 20 publicly exposed Cairn dashboards assessed as likely associated with malicious activity. These interfaces revealed targets, agent decisions, findings, and, in some cases, credentials and evidence of persistent access.
Reuters' October 19 investigation independently reviewed the attacker's activity to identify affected companies. The Hacker News followed on October 20, bringing together the technical findings and reported impact.
The important development is not an AI system deciding on its own to become a criminal. Human operators selected targets and objectives. The agents then performed much of the iterative investigation and exploitation work. This distinction matters: the case illustrates automation of attacker labor, not the disappearance of human intent or responsibility.
What the Evidence Establishes
Cairn is a general-purpose, multi-agent problem-solving framework that can be used for authorized security testing. In the operations NorForge examined, it was also used against real websites without permission. Its architecture lets workers record findings on a shared project board, select subsequent actions, and pursue a defined objective; operators can supply additional hints.
NorForge grouped the observed activity into three clusters. The largest, AIA0001, used Chinese-language tasking and connected 14 panels with more than 1,100 attack projects in the research snapshot. Its apparent objective was persistent access to shopping and payment infrastructure for later monetization. A second, English-language cluster pursued financial theft. NorForge assessed a third cluster as malicious with lower confidence.
Reuters reported that the prolific Chinese-speaking operator's agents had attempted more than 1,200 website intrusions and compromised sites associated with more than 100 companies. Those figures should not be treated as interchangeable with NorForge's project count: they describe different units and reporting snapshots. Neither establishes that every targeted website was breached or that every affected company's internal network was compromised.
There is evidence beyond agent-generated success messages. NorForge checked a reported intrusion at a hardware-parts vendor and found an upload web shell present. It also says it independently validated an intrusion involving a large US retailer. These checks support the conclusion that some attacks succeeded, but do not independently validate every project marked successful across the exposed panels.
A Website Intrusion Is Not a Confirmed Enterprise-Wide Breach
Reuters identified Deere, SharkNinja, and Cummins in its review and sought their responses. The responses materially limit what can be concluded:
- Deere said it had taken remediation measures and had no indication that sensitive information had been accessed.
- SharkNinja said the incident affected a standalone product-support website and that the threat had been contained.
- Cummins said it was investigating a possible attack on a website operated by a third-party vendor.
Two smaller businesses also acknowledged compromises to Reuters. However, Reuters could not establish the extent of unauthorized data extraction from the reported breaches. That uncertainty should remain explicit: observed access, exposed credentials, and confirmed exfiltration are different findings.
The three articles also share an underlying investigation. They provide complementary technical analysis, journalistic verification, and synthesis, not three independent datasets measuring the same campaign.
Why the Economics Matter, and Where the Numbers Stop
NorForge estimates an approximately 10% goal-completion rate across the activity it observed, while warning that objectives and targets differ between clusters. For successful AIA0001 projects, the average time from start to goal completion was a little under 23 hours, with substantial variation. That is not the average duration of all attempts and is not a universal benchmark for AI-enabled attacks.
Costs are less certain. NorForge did not have actual token-usage records and estimated roughly $5 per task, including unsuccessful or short-lived attempts; some longer tasks could exceed $100. Fagerland separately estimated to Reuters approximately $5,000 in campaign token costs, or around $50 per successful intrusion. These are approximate token-cost estimates, not audited operating expenses or guaranteed prices for a breach.
The strategic implication is nevertheless significant. Automation can make repeated, patient probing affordable even when most attempts fail. A defender's exposure is therefore not determined only by whether an attack is technically novel: neglected applications, forgotten support sites, and weak administrative interfaces can become economical targets at scale.
Worker names suggested the use of DeepSeek models with coding-agent frameworks, including Claude Code, but those labels do not conclusively establish the underlying model configuration. Similarly, Chinese-language instructions do not establish nationality, state sponsorship, or the number of people operating a cluster. NorForge saw apparent financial motivation and no obvious state-sponsored activity in the exposed sample.
The Second Incident: Exposed Agent Workspaces
The dashboards created a separate security problem. They revealed project targets, discovered weaknesses, credentials, API keys, and information supplied by operators. A target could suffer additional exposure even if an individual intrusion attempt did not reach its stated goal.
NorForge ran TruffleHog against the collected data and reported hundreds of secrets, with about 11% verified as valid by the scanner. Failure to verify the remaining items does not establish that they were harmless or invalid.
The panels also appeared to expose administrative controls. NorForge explicitly says it did not test whether those controls could be used without authorization. It would therefore be inaccurate to claim that researchers demonstrated takeover of every exposed agent system.
This problem extends to legitimate security teams: NorForge also found apparently authorized testing operations exposing client work through unsecured dashboards. An AI testing platform that aggregates customer secrets and vulnerability findings must itself be treated as sensitive infrastructure.
Defensive Priorities
The following recommendations are defensive analysis informed by the reporting, rather than claims that any particular product would have prevented these incidents.
- Inventory the full web estate. Include support portals, vendor-operated sites, legacy applications, and administrative interfaces. Assign owners and confirm whether each service needs to be publicly reachable. A low-profile website can still provide valuable access.
- Reduce exploitable paths. Patch affected applications and dependencies, isolate session stores and management services, enforce authorization, and prevent uploaded files from executing as application code. The reported attacks followed different paths; there is no single Cairn vulnerability to patch.
- Investigate behavior, not presumed AI identity. Correlate sustained probing with unusual file creation, unexpected upload forms, application-process activity, authentication anomalies, and outbound transfers. A suspicious request does not reveal whether a human or an agent generated it.
- Protect agent control planes. Keep testing dashboards behind authenticated, restricted access; separate tenants and projects; minimize stored secrets; and log access. Authorized agents should have explicit target scope, restricted credentials and network access, and human approval for high-impact actions.
- Treat exposed secrets as an incident. Preserve evidence, revoke or rotate affected credentials, examine downstream service activity, and coordinate with owners of connected systems. Removing a dashboard or a web shell does not invalidate credentials already copied elsewhere.
NorForge found exploit-research tools in a worker environment, including material related to Magento. Tool possession alone does not prove that a particular vulnerability was used against a particular victim. Remediation should follow verified exposure and current vendor advisories, not assumptions drawn from an attacker's toolkit.
Defenders should also avoid visiting or testing suspected attacker dashboards themselves. Some contain live victim information, and interacting with operational controls could affect third parties. Use established incident-response and disclosure channels for sensitive indicators.
The Takeaway
The Cairn investigation documents real intrusions alongside important uncertainties. It supports a practical conclusion: AI agents can carry out substantial, adaptive attack work under human direction, while poor operator security can expose both the operation and its victims.
For defenders, the response is not simply to look for an AI signature. It is to shorten exposure windows, monitor the applications that rarely receive attention, protect credentials, and secure the agent systems deployed for legitimate work. The automation is changing the economics; the underlying failures still demand concrete engineering and incident-response work.
Sources
- NorForge: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations, October 19, 2026. Primary investigation, cluster analysis, validation examples, and methodological limitations.
- Reuters: How one hacker used AI agents and a few thousand dollars to break into scores of sites, Raphael Satter, October 19, 2026. Review of attacker activity and company responses.
- The Hacker News: Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites, Swati Khandelwal, October 20, 2026. Technical and news synthesis.
Prepared October 20, 2026. Counts, attribution, and impact reflect the cited reporting available at that date. Cost and success-rate figures are estimates, not independently audited measurements.