AI Agents Breach 100 Sites, Including John Deere and SharkNinja

Key points

• Norforge discovered that a hacker used Cairn, an open-source AI platform, to attack over 100 websites across the US, Canada, Australia, and Japan.
• Reuters confirmed victims included John Deere, SharkNinja, and Cummins, though Norforge did not name them in its initial report.
• The attacker provided fewer than 100 Chinese characters of instructions, and the AI agents completed breaches in about 23 hours with minimal human involvement.
• John Deere stated no sensitive information was accessed, while SharkNinja confirmed the breach affected only a standalone support site and was contained.
• Cummins is investigating a potential cyber-attack on a website operated by a third-party vendor.

Background

This incident follows earlier reports in September 2026 by Google and Hunt.io regarding Chinese state-linked hackers using AI agents to automate intrusions against North American targets. Those reports noted that such AI-driven campaigns could reduce intrusion times to under six hours, highlighting a growing trend in autonomous cyber operations.

How outlets are covering it

The Verge and PYMNTS emphasize the autonomous nature of the attacks, noting that the AI agents operated with little human involvement. PYMNTS frames this as part of a broader 'war of attrition' in cybersecurity, where attackers can deploy inexpensive AI agents around the clock. In contrast, Bioengineer.org focuses on the technical capabilities of AI-driven penetration testing, citing a study on PentestMCP that achieved high success rates in vulnerability discovery and exploitation. GBHackers News mentions AI-assisted attacks on South Korean banks but does not provide specific details related to the Cairn incident. The Verge and PYMNTS highlight the real-world impact on major companies, while Bioengineer.org focuses on the theoretical and technical advancements in AI security tools.

Why it matters

The incident demonstrates the increasing capability of AI agents to conduct large-scale, autonomous cyberattacks, raising concerns about the security of major corporations and the potential for widespread breaches. It highlights the need for enhanced cybersecurity measures and the dual-use nature of AI tools in both offensive and defensive contexts.

What to watch

Norforge is working to take down the malicious Cairn instances. Companies like John Deere, SharkNinja, and Cummins are expected to continue monitoring for further breaches and implementing additional security measures. The broader cybersecurity community may see increased focus on AI-driven threats and the development of defensive AI tools.