Open Cairn control panels showed AI agents breaking into company websites, including Deere and SharkNinja

Cairn takes a starting point and a goal and dispatches AI agent "workers" that record findings on a shared board until the goal is met; its public code supports Claude Code, Codex and Pi as worker software. NorForge, following a September Gambit Security report that found Cairn on a criminal's staging server, used the internet scanning services Shodan and Censys to find Cairn web panels. Reuters reports that NorForge's researcher Snorre Fagerland began finding malicious instances around October 2. NorForge judged more than 20 panels likely malicious and grouped them into three clusters. (NorForge; Cairn repository; Reuters via CP24)

The busiest cluster, AIA0001, wrote in Chinese and ran 14 panels. NorForge says an automated pipeline fed it targets. A typical task described them as e-commerce sites in four countries with claimed traffic of 200,000 to 1.5 million and said the browser-automation tool Playwright had checked that orders could be placed. The same task told the agents to find unauthenticated remote code execution (by SQL injection, unsafe deserialization, file upload or similar flaws), to prove it with whoami or id output, and then to plant an "uploader shell," a form that saves uploaded files rather than one that runs commands. NorForge says the aim appeared to be lasting access to shop and payment systems for later use. All AIA0001 tasks it saw ran on a worker named claudecode_deepseek-v4.1-flash, which NorForge says "could mean" Anthropic's Claude Code agent software driving DeepSeek's V4.1 Flash model; Reuters says the campaign "appeared to be using a mixture of China's DeepSeek and Anthropic's Claude Code." Neither source shows whether any Anthropic model processed the requests. Successful AIA0001 tasks took a little under 23 hours on average. (NorForge; Reuters via CP24)

The two other clusters were smaller. AIA0002 wrote in English, ran 10 panels and 71 projects, and told agents to steal credit cards and cryptocurrency; NorForge says its workers used DeepSeek models through the OpenRouter gateway. AIA0003, rated malicious only with low confidence, ran one panel with 59 projects. Reuters reports that one of the observed actors stole "a trove of credit card data"; it does not say which cluster. The "$50 per successful hack" figure is Fagerland's estimate to Reuters of about $5,000 in tokens divided by the successful break-ins; NorForge's written estimate is about $5 per task including failed ones, with "considerable" uncertainty. (NorForge; Reuters via CP24)

Operator's automated pipeline ranks shops by traffic, checks them with Playwright
  -> creates Cairn project: goal = unauthenticated code execution, then uploader web shell
  -> Cairn dispatches worker "claudecode_deepseek-v4.1-flash"
     (model mix reported as Claude Code + DeepSeek V4.1 Flash; not confirmed)
  -> agents probe the target site for hours: SQL injection, deserialization,
     file upload, authentication bypass
  -> agent reports code execution and a planted uploader web shell   [agent claim]
  -> NorForge finds the shell live / chain valid in a few cases        [checked sample]
  -> later use of the access or data taken                              [unknown]

Separately:
Operator's Cairn panel reachable from the internet with no login (port 8000)
  -> targets, findings, harvested credentials and API keys readable by anyone
  -> after October 19, third parties deface and take over exposed panels

Two boundaries failed. The first is on the victims' side: in the few cases NorForge checked, shop software let an unauthenticated visitor install a shell or run code on a web server. NorForge's one detailed example, by the agent's own account, combined write access to a memcached session store with unsafe PHP object deserialization in old Zend Framework components. The techniques NorForge lists (SQL injection, deserialization, file upload, authentication bypass) are established web-attack classes; what its evidence shows is agents working through them for hours with little human input. (NorForge)

The second failure is on the operators' side. "Exposed Cairn panels" means the attackers' own control panels, not someone else's deployment. NorForge says the panels appeared to give any visitor the controls to start, stop or redirect agent tasks. It did not test those controls; its follow-up reports that others did and used them to plant SSH keys and malware on Cairn hosts. Cairn's recommended Docker Compose setup publishes its web server on port 8000 on all network interfaces. The server code reviewed for this record contains no login check, although the manual cairn serve command listens only on the local machine by default. NorForge also found legitimate penetration-testing firms with client work on open panels. Of the hundreds of secrets it found in panel data, the scanner Trufflehog verified 11% as valid. (NorForge; NorForge follow-up; Cairn repository)

Confirmed effects are narrower than the headline count. SharkNinja and two smaller businesses acknowledged compromises, and Deere told Reuters it had taken remediation actions. Cummins's statement concerns a website run by a third-party vendor, not its own systems. NorForge confirmed the outcome in a few cases: a live web shell at one hardware parts vendor, a command shell at one Australian e-commerce site and a validated chain at one very large US retailer. (Reuters via CP24; NorForge)

NorForge assessed that AIA0001 sought access rather than immediate theft, and noted that an uploader shell could later be replaced with something more harmful. Whether the operator used the access after the panels went offline on October 20 is unknown. Across all three clusters, NorForge's figure lists 134 projects with outcome claims. Of those, 28 were described as database access or data exfiltration and 9 as payment card data. The figure does not split these by cluster, so it does not show that AIA0001 took data. (NorForge; NorForge follow-up)

The open panels caused a second exposure: credentials and API keys gathered from targets sat in publicly readable panel data. After publication, unknown actors took over open Cairn hosts, including some belonging to red teams. NorForge did not establish whether victims' exposed credentials were reused. (NorForge; NorForge follow-up)

Cairn's author acknowledged a Reuters message but did not immediately answer its questions. In a post on X relayed by Reuters, the author said the platform was "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention." The X post was not read directly. The repository's README disclaimer limits use to systems where the user has "explicit authorization to operate." As of November 6, the latest commit on the repository's main branch was dated September 7, 2026, so no code or documentation change there followed the disclosure. (Reuters via CP24; Cairn repository)

NorForge says it worked with Reuters to notify victims and asked hosting providers to take panels down; it said success depended on the hosts. It did not report whether any provider acted, and it does not attribute the October 20 disappearance of the AIA0001 panels to a takedown. Searches through November 6 found no public statement on this case from Anthropic, whose Claude Code software may have served as the agent harness, or from DeepSeek. The affected companies' statements appear only as given to Reuters. The searches conducted for this record found no company notice; SEC EDGAR filings were not searched. (NorForge; NorForge follow-up)