NorForge: One Hacker's AI Agents Breached 100+ Sites Including Deere at $50 Each

TL;DR

On October 19, NorForge principal threat researcher Snorre Fagerland published Inside Cairn, a report on more than 20 internet-exposed control panels for Cairn, an open-source AI agent engine, that NorForge judges likely malicious. The busiest operator, a Chinese-language cluster, ran more than 1,100 attack projects against online shops. Reuters saw the report before publication and says those agents tried more than 1,200 sites and broke into more than 100, including sites tied to Deere, SharkNinja and Cummins, for roughly $5,000 in tokens. The worker label on the panels reads claudecode_deepseek-v4.1-flash.

What NorForge actually found

Cairn runs as a web panel. Some operators left theirs open to the internet without a login, and NorForge found them with Shodan and Censys searches. According to The Next Web, the campaign started on September 25 and Fagerland began finding panels around October 2.

Because the panels were open, NorForge could read each operator's projects, targets, agent notes and results. The report calls them "open windows" into AI-driven operations. All three clusters it describes look financially motivated, and NorForge saw no obvious sign of state sponsorship.

• AIA0001 (Chinese-language, high confidence): 14 panels and more than 1,100 attack projects. It went after e-commerce and payment infrastructure, mostly in the US, Japan and Australia, and the goal was a persistent uploader web shell. The worker string is claudecode_deepseek-v4.1-flash, which NorForge reads as a Claude Code harness driving DeepSeek's V4.1 Flash model.
• AIA0002 (English-language, high confidence): 10 panels, mostly on Vultr VPS hosting, chasing credit cards and cryptocurrency on gray-market, pharma and African commerce sites. Its worker string is pi_openrouter_deepseek: the Pi coding agent calling DeepSeek through OpenRouter.
• AIA0003 (English-language, low confidence): one panel with 59 exploratory projects aimed at shell, admin or database access.

How Cairn works

Cairn's README describes it as "a general-purpose problem-solving engine" that was "validated first on autonomous penetration testing." You give it an origin (a target) and a goal (a shell, a flag). Agent workers then build a graph from one to the other using three primitives: a Fact is a confirmed finding, an Intent is a direction someone plans to explore, and a Hint is human judgment the operator can drop in at any time.

The same worker runs three task types. Bootstrap tries to solve the problem outright, Reason reads the whole graph and proposes new intents, and Explore claims one intent, runs it and writes back one fact. Workers never talk to each other. They coordinate only through the shared board.

Picture a squad of detectives who never speak and only communicate by pinning index cards to one corkboard. Each detective walks in, reads every card, picks an unclaimed lead, chases it and pins up what they found. Nobody is in charge, and the case still moves.

That design is why the operator's input could be so small. NorForge's English translation of the AIA0001 brief comes down to three lines: priorities are "Login SQL injection, unauthenticated endpoints, file uploads, deserialization," the payload is an uploader shell built on an HTML form and move_uploaded_file, and the objective is "Find unauthenticated RCE." Reuters puts the original brief at under 100 Chinese characters.

Cairn's author, who posts as le1xia0, said on X that the software was not built for hacking: "If it is used to carry out harmful hacking attacks, that is not my intention." The repo is AGPL-3.0 and has 3,892 GitHub stars and 683 forks. Its README carries Tencent hackathon branding, and NorForge notes the attackers reused a Tencent CTF configuration, but the report adds that "there is no reason to believe that Tencent had anything to do with this operation."

Also, this Cairn has nothing to do with the CAIRN malware-hunting toolkit from Cisco Talos that we covered last month. Security has a naming problem.

The economics: about $5 a try

NorForge puts the average success rate across the Cairn campaigns it examined at about 10%, and warns that the clusters had different goals, so the rate is a blend. For AIA0001 projects that reached their goal, the average time from start to goal was a little under 23 hours and the average project logged 140 facts. One project ran for more than five days.

On cost, NorForge estimates the average task at around $5 once you count projects that failed or ended early. Projects with more than 1,000 intents and facts could cost over $100. The report says the uncertainty is "considerable" and the numbers "could be off by a clear margin." Fagerland's rougher estimate to Reuters, as reported by The Next Web, is about $5,000 in tokens for the whole AIA0001 run, or roughly $50 per successful hack.

At around $5 an attempt, nobody has to decide whether your mid-sized online shop is worth a human's afternoon. The Next Web says AIA0001 aimed at shops with traffic in the 200,000 to 1.5 million range, which is where a lot of small businesses sit.

Who got hit, and what they said

NorForge did not name victims. Reuters did, and The Verge relayed the company responses:

• Deere said there is "no indication that sensitive information was accessed."
• SharkNinja said the breach hit a standalone site with product support information and that it has contained the threat.
• Cummins said it is "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors."

Reuters could not establish how much data, if any, was taken. NorForge says it is working with Reuters to warn victims and asking hosting companies to pull the panels down.

One chain NorForge confirmed

The report confirms a live uploader web shell on the site of a large hardware parts vendor. The chain it describes is old-fashioned: unauthorized write access to a memcached session store, unsafe PHP deserialization, then a gadget chain in legacy Zend Framework components. Every step is a bug class with years of public write-ups behind it. What the agents added was persistence at a few dollars a try.

The attackers left their own doors open

The exposed panels also leaked what the operators had gathered. NorForge found "literally hundreds of secrets of different kinds," and TruffleHog verified 11% of them as valid. The crews hunting for unauthenticated endpoints got caught through an unauthenticated endpoint, which is about as tidy as threat intelligence gets.

The criminals were not the only ones exposed. NorForge says "a considerable number of apparently legitimate red team operations were also exposed this way," and calls putting real customer penetration tests on an unsecured panel "highly problematic." If your security vendor uses an agent harness, ask where its panel lives.

This is also the second sighting of Cairn in criminal hands. NorForge cites a September report from Gambit Security, which recovered an attacker's staging server in a campaign against online marketplaces and found AI harnesses including Hermes, Strix and Cairn on it.

What to do about it

• Patch the boring list. The operator's priorities were login SQL injection, unauthenticated endpoints, file uploads and deserialization. None of that is new, so the controls aren't either: parameterized queries, auth on every route, strict upload handling, and no untrusted input into unserialize().
• Find your legacy PHP. The confirmed break-in ran through old Zend Framework components and a writable memcached store. Support sites and vendor-run microsites, the kind SharkNinja and Cummins described, are where that code tends to survive.
• Lock down your own agent panels. If you run Cairn or any agent harness for testing, keep the UI behind auth or a VPN. NorForge found these panels with ordinary Shodan and Censys searches.
• Don't count on model guardrails here. The harness and the model came from different vendors: a Claude Code harness pointed at DeepSeek, and Pi routed through OpenRouter. Whatever one vendor's model refuses, your own perimeter still has to hold.

Caveats

The victim names and the 1,200 and 100 counts come from Reuters, which saw the report early. NorForge itself withheld names. The cost figures are rough estimates that NorForge explicitly says could be well off, and the 10% success rate mixes clusters with different goals. The worker string suggests Claude Code driving DeepSeek V4.1 Flash, but a label in a panel is the operator's naming choice, and NorForge frames it as "could mean."

Key Takeaways

• NorForge found more than 20 exposed Cairn panels it judges likely malicious, split into three financially motivated clusters.
• Per Reuters, the busiest operator's agents tried more than 1,200 sites and breached more than 100, including sites tied to Deere, SharkNinja and Cummins.
• Cost estimates run about $5 per task including failures and roughly $50 per successful breach, with a success rate near 10% and under 23 hours to goal.
• The agents used old bug classes (SQL injection, file uploads, PHP deserialization) and ran on a Claude Code harness with what looks like DeepSeek V4.1 Flash.
• The panels leaked hundreds of secrets (11% verified valid) and exposed legitimate red team client work too.
• Cairn is AGPL-3.0 open source with 3,892 stars, and its author says it was not designed for hacking.

Sources: NorForge: Inside Cairn, Cairn on GitHub, The Next Web, The Verge, Slashdot, The Next Web on Gambit Security