A threat actor used a collection of largely autonomous AI agents to compromise more than 100 websites, according to findings from AI security company Norforge. The campaign, disclosed by The Verge on October 19, 2026, reportedly reached websites associated with John Deere, SharkNinja and Cummins.
The names of those organizations come from Reuters reporting cited by The Verge, not from Norforge, which did not publicly identify the targets in the account reviewed. The affected websites were linked to companies in the US, Canada, Australia and Japan.
Exposed Cairn deployments revealed the activity
Norforge found the operation by examining publicly exposed activity on Cairn, an open-source platform for coordinating AI agents. It identified more than 20 exposed Cairn instances that it assessed as “likely malicious” and said it was working to have them removed.
Cairn describes itself as a “general-purpose problem-solving engine.” A user supplies a starting point and a desired outcome, after which agents work toward that objective while recording their progress.
That model can also be applied to offensive security tasks. Reuters reported that the most active attacker among the instances identified by Norforge expressed its preferred intrusion methods in fewer than 100 Chinese characters. The agents then handled most of the work required to pursue targets. Successful compromises reportedly took about 23 hours.
The figures describe websites and Cairn instances, not unique people or confirmed enterprise-wide breaches. The available reporting also does not establish that every exposed instance belonged to the same operator.
Cairn was created by the account @le1xia0. Earlier in October 2026, the creator said the platform “was never a ‘hacking tool’” and argued that malicious use reflects a human decision rather than an intended feature. That is the creator’s characterization of the technology.
Companies describe narrower effects
Statements from the named organizations indicate that the reported activity involved specific web properties rather than necessarily providing access to their wider corporate environments.
A John Deere spokesperson told Reuters there was “no indication that sensitive information was accessed.”
Cummins said it was investigating a report of a potential cyberattack involving a website operated by one of its third-party vendors. Its statement leaves the event under investigation and places the potentially affected site outside the company’s direct operation.
SharkNinja said the breach concerned a standalone website containing product-support information and that the threat had been contained.
These accounts establish different levels of impact: John Deere addressed possible access to sensitive information, Cummins described a potential incident at a vendor-operated site, and SharkNinja confirmed an intrusion into a separate support website.
AI orchestration expands the web attack surface
The campaign illustrates how agent orchestration can reduce the amount of direct human involvement needed to pursue numerous websites. It does not show that the agents operated without human direction: the attacker still defined tactics and objectives, while the software coordinated the work.
For defenders, the immediate concern extends beyond primary corporate domains. Product-support portals, supplier-hosted services and other standalone websites may contain useful information or provide a foothold even when they are separated from core business systems.
Organizations should include those properties in asset inventories and security monitoring, including sites operated by outside vendors. Operators of AI-agent platforms should also treat public exposure as a security risk, restrict unnecessary internet access and review recorded task activity for unauthorized intrusion work. Norforge’s effort to remove the instances it identified is aimed at disrupting the exposed infrastructure used in the reported campaign.
