A Hacker Used AI Agents to Breach Over 100 Websites. This Is Just the Beginning.

A hacker recently managed to break into more than 100 websites using a swarm of AI agents that operated with minimal human oversight. The victims included well-known names like John Deere, SharkNinja, and Cummins. What makes this attack notable is not just the scale, but how it was carried out: the hacker described their intrusion strategy in fewer than 100 Chinese characters, then let the AI agents handle the rest.

The tool at the center of the operation is called Cairn, an open-source platform that bills itself as a general-purpose problem-solving engine. With Cairn, users set a starting point and an end goal, and the AI agents document their progress as they work toward completing the task. In theory, this is useful for legitimate automation. In practice, the same feature set makes it an ideal vehicle for automated cyberattacks.

Security researchers at Norforge, an AI security firm, discovered more than 20 exposed Cairn instances that appeared to be operating with malicious intent. The most active among them had been systematically targeting companies across the United States, Canada, Australia, and Japan. According to Reuters, the attacker laid out "preferred intrusion tactics" using fewer than 100 Chinese characters, and successful breaches took roughly 23 hours from start to finish.

The affected companies have acknowledged the incidents with varying degrees of detail. John Deere stated there was "no indication that sensitive information was accessed." SharkNinja confirmed the breach impacted a standalone site containing product support information and said it had contained the threat. Cummins issued a more cautious statement, noting it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors."

This incident sits at an uncomfortable intersection of two trends that have been accelerating in parallel: the growing capability of autonomous AI agents, and the expanding attack surface created by organizations that rely on third-party vendors and cloud infrastructure. The hacker did not need to write complex exploit code or maintain constant oversight. They simply defined the objective and let the agents iterate until they found a way in.

Cairn's creator, who goes by @le1xia0, pushed back on the framing that Cairn is inherently a hacking tool. In a statement earlier this month, they said the platform "was never a 'hacking tool'" and that "misuse is a human decision, not a feature of the engine." That argument will sound familiar to anyone who has followed debates around dual-use technology, but it does not change the practical reality that tools designed for broad problem-solving are inherently difficult to constrain.

Norforge says it is working to get the malicious Cairn instances taken down, but the broader issue is harder to address. As AI agents become more capable, the gap between legitimate automation and malicious exploitation narrows. A tool that can autonomously debug a web application can also autonomously probe it for vulnerabilities. The same reasoning capabilities that make AI agents useful for developers make them dangerous in the wrong hands.

The regulatory response so far has been reactive rather than preventive. The FTC has reportedly subpoenaed OpenAI and Anthropic for details on AI-related security incidents, suggesting that policymakers are beginning to grasp the scope of the risk. But subpoenas after the fact are not the same as frameworks that prevent misuse before it happens.

For organizations, the takeaway is straightforward but not easy: assume that automated, AI-driven attacks are already happening and will only become more common. That means rethinking perimeter security, scrutinizing third-party vendor access, and preparing for a threat landscape where a single attacker can operate at a scale that previously required a nation-state level of resources.

The 100-website breach is not just a story about one hacker and one tool. It is a preview of what happens when capable AI agents are pointed at real-world targets with minimal friction and even less oversight.