Cairn: AI agents broke into 100+ company websites, a researcher says. What that number counts

At a glance

Bottom line: Cheap AI agents can now spend most of a day, or several, on a single web target. The weaknesses NorForge describes are mostly ordinary bugs in custom code and in exposed supporting systems. Exposure management, egress control and file-integrity monitoring now carry more of the load.
The number: "More than 100 companies" is NorForge researcher Snorre Fagerland's count for one Chinese-speaking operator, as reported by Reuters, taken from the attacker's own panel data. NorForge's report gives over 1,100 attack projects and an estimated success rate of about 10%. Four victims acknowledged an incident to Reuters as of October 19, 2026.
The tool: Cairn is an open-source AI search engine whose README says it was validated first on penetration testing; its author says it was not designed for hacking. NorForge says the operator's agents ran DeepSeek V4.1 Flash, and infers from a worker name that Claude Code was the harness.

What was reported

On October 19, 2026, NorForge published "Inside Cairn" by its researcher Snorre Fagerland. NorForge says that by scanning the internet it found more than 20 Cairn control panels that anyone could open and that were likely used for crime. Cairn directs AI agents toward a goal. The lead came from Gambit Security, which had named Cairn in a September report on AI-driven attacks against online retailers.

NorForge groups the panels into three clusters, all apparently financially motivated, with no obvious state activity. The largest, AIA0001, writes in Chinese and runs 14 panels with more than 1,100 attack projects. NorForge says it targets mostly the US, Japan and Australia and seems to want lasting access to e-commerce and payment infrastructure. AIA0002 writes in English, runs about 10 panels and, NorForge says, talks openly about stealing cards and cryptocurrency. AIA0003 is one panel with 59 projects, rated malicious with low confidence.

The same day, Reuters reported that Fagerland had watched the Chinese-speaking operator break into the websites of more than 100 companies. NorForge names no victims. Reuters says it identified them by reviewing the operator's Cairn data, and names Deere, SharkNinja and Cummins.

Timeline

September 8, 2026CISA lists CVE-2026-75650 in Adobe Commerce and Magento as exploited (CISA).
September 22, 2026Gambit Security reports an AI-driven campaign against retailers that used Cairn (Gambit).
September 25, 2026The Chinese-speaking operator starts on US, Canadian, Australian and Japanese shops (Reuters).
October 2, 2026Around this date Fagerland starts finding malicious Cairn panels (Reuters).
October 19, 2026NorForge publishes its report; Reuters names victims (NorForge, Reuters).

What Cairn is, and how much of this is AI

Cairn's GitHub README calls it a general-purpose engine that searches for a path from a starting point to a goal, validated first on penetration testing. Agents post findings to a shared board, declare what they will try next, and a human can add hints at any time. Workers run on the Claude Code, Codex or Pi agent tools. The README restricts use to authorized systems. Its author, le1xia0, wrote on X that the platform "was not designed for hacking attacks", Reuters reports.

Much of the campaign is plain automation. NorForge describes a feed that ranks shops by traffic, checks with browser automation that orders can be placed, and fills a task template. A buggy domain normalizer that drops a letter "w" from site names ties the panels together. The AI sits after that: language-model workers choose each next step and drive standard reconnaissance and scanning utilities, which NorForge says it saw in one worker's directory.

The model claims need care. NorForge says every AIA0001 task ran on a worker named for DeepSeek V4.1 Flash, and that the name "could mean" a Claude Code harness running that model. Reuters wrote "a mixture of China's DeepSeek and Anthropic's Claude Code". Neither says Anthropic's models did this work. In Gambit's separate campaign, Gambit says the orchestrating agent ran on Claude Opus 4.6 after newer models refused its requests.

A human stays in the loop, briefly. Reuters says the operator's instructions ran to fewer than 100 Chinese characters. Gambit counted 1,951 human prompts across 260 sessions, a few per target. Fagerland told Reuters the find is evidence that agents can complete intrusions without human intervention. That is his reading of panels that record the agents' own claims of success.

What "100+ companies" counts

It is a researcher's count, reported by Reuters, not a confirmed tally of breaches. NorForge's report does not state it. The report gives over 1,100 AIA0001 projects and an average success rate of "around 10%", which NorForge calls "a reasonable assumption". Reuters says more than 1,200 sites had been attempted. Fagerland's cost estimate in Reuters fits: about $5,000 of tokens at about $50 per successful hack. NorForge's own estimate is about $5 per task, with "considerable" uncertainty.

A success means Cairn marked the goal as met, usually a planted web shell. NorForge says it spot-checked: a shell URL from one completed task against a large hardware parts vendor did serve a web shell, and it validated the chain at a very large US retailer.

Victims tell a smaller story. Deere told Reuters it took "necessary remediation actions" and has "no indication that sensitive information was accessed". SharkNinja said a standalone product-support site was hit and contained. Cummins said it is investigating a report of a potential attack on a site run by a third-party vendor. Two smaller businesses acknowledged compromise; others did not reply. Reuters could not establish how much data was taken. These are website break-ins, some peripheral, not 100 corporate networks.

Bar chart. Attack projects in the largest Cairn cluster: over 1,100 (NorForge). Websites the operator reportedly broke into: more than 100 (Reuters, citing Fagerland). Victims that acknowledged an incident to Reuters: 4. — The first two bars are lower bounds. The four acknowledgements are Deere, SharkNinja and two smaller businesses; Cummins was still investigating.

Do not merge this with Gambit's figures. Gambit says its campaign compromised at least 27 companies, took over 600,000 card records from two, and that more than 100 further websites carried a linked skimmer. That is a different "100+", a different operator and a different harm.

How they got in, and who was hit

The AIA0001 tasking NorForge translates asks for unauthenticated code execution and prioritizes login forms, unauthenticated endpoints, file uploads, unsafe deserialization, authentication bypass and account takeover. The intrusion paths NorForge describes are mostly custom-code and configuration bugs: a session cache writable from outside, legacy PHP framework components, an account-modification flaw, leaky error handling, and routing that reached an older backend. Reuters adds that when one large company's main application held, the agents located an exposed control panel on related infrastructure and reported running commands on its server.

NorForge ties no CVE to a named victim. It says one worker's directory held a research proof-of-concept for CVE-2026-75650 in Adobe Commerce and Magento, plus Odoo framework source files. Adobe scores CVE-2026-75650 at 10.0 (CVSS 3.1, as listed in NVD), weakness CWE-1336. Akamai gives the affected versions as Commerce and Magento Open Source 2.4.4 through 2.4.9 and Commerce B2B 1.3.3 through 1.5.3; Adobe's fix is bulletin APSB26-146.

NorForge's case studies cover Australian, Japanese and US retailers and a restaurant point-of-sale system. It says AIA0002 went after merchant payment services, gray-market payment and pharmaceutical sites, and African shops.

What changes when the attacker is an agent

This is our reading of the vendors' data. Cost no longer filters targets: at a few dollars a try, every site with a working checkout gets one. Gambit says its operator deliberately dropped shops on major commerce platforms to keep custom-code ones. Your bespoke code is the target, and no vendor patch will ever arrive for it.

Patience is free. NorForge says successful AIA0001 projects took a little under 23 hours on average, one ran over five days, and Gambit says access usually came in under a day. Detection tuned for a scanner's burst, or for a human who gives up, misses an agent that keeps going.

And the attack goes around the front door. When the main application held, the agents went for related hosts, panels and caches. Whatever you forgot to inventory is the soft spot.

Which controls still hold

Patch speed, for known flaws. If you run Adobe Commerce or Magento, confirm APSB26-146 is applied. CISA gave US federal agencies three days for this one.
Exposure management, more than ever. Inventory subdomains, staging hosts, admin consoles and old backends. Keep session stores and caches off the internet.
Rate limits raise cost but will not stop a patient agent. Gambit lists commercial proxy services used against targets, so key limits to accounts, sessions and sensitive endpoints, not only IP addresses.
MFA, for admin and staff logins. NorForge says panels held credentials harvested elsewhere. MFA does nothing against an injection flaw that never touches the login page.
Egress control. NorForge describes out-of-band testing and Gambit reports exfiltration over DNS. Web servers that cannot open arbitrary outbound connections break both.

What to watch for

New script files in web roots and upload folders, especially small upload forms with ordinary names in deep directories. NorForge says AIA0001 tasks demanded an upload-form shell, and AIA0002 asked for one hidden deep under a harmless name.
Changed JavaScript on checkout pages. Gambit says skimmer code was appended to real library files with timestamps restored, so compare hashes, not dates.
Sustained, varied probing of one application over hours or days: logins, uploads, error pages, APIs.
Unexpected outbound connections from web servers, including DNS lookups to unfamiliar domains.
Error pages that expose stack traces or internals.
NorForge's indicators: two staging-server addresses, partly redacted panel addresses and hosting networks, with the full list offered to bona fide researchers. Panel hosting does not tell you where attack traffic comes from.
If NorForge or Reuters notified you, assume your secrets sit on an open panel and rotate them. NorForge says 11% of the hundreds of secrets it scanned were valid.
If you run Cairn or a similar harness for real tests, keep its panel off the internet. NorForge says it found client engagements exposed too.

The uncomfortable part

Fagerland told Reuters some of the agents' work was "not script kiddie stuff". The defenses are old and unglamorous anyway: know what you expose, patch what has a patch, watch your files and your egress. These attackers left their own consoles open to the internet. Agents like theirs will still probe every forgotten corner of yours, around the clock. Find those corners first.