A single attacker, using the open-source AI agent platform Cairn, autonomously breached more than 100 companies’ websites — including John Deere, SharkNinja, and Cummins — across the US, Canada, Australia, and Japan since September 25, 2026. NorForge threat researcher Snorre Fagerland documented the findings; Reuters reviewed the report before publication and identified some victims by examining the hacker’s activity. (The Hacker News, SecurityWeek, The Next Web)
The numbers that matter: the attacker left nearly all the work to AI agents, at roughly $50 of inference cost per target, with each successful intrusion taking about 23 hours of agent activity. More than 1,200 sites were targeted; over 100 were successfully breached. Cairn’s author (posting as “le1xia0”) told Reuters the tool wasn’t designed for hacking and that harmful use wasn’t the intent — but the exposed panels allowed anyone to repurpose it for autonomous attacks.
Why this is a different story than governance news
Most of the AI-agent coverage this year has been about an organization governing its own deployed agents — credentials, runtime permissions, monitoring dashboards. This is the inverse: an outside attacker using agentic tooling offensively, autonomously, at a cost and skill floor that used to require a much larger operation. That’s a genuinely different risk category for IT leaders to think about — not “is my internal agent behaving,” but “has the cost of mounting a sustained external attack against my public-facing systems just dropped by an order of magnitude.”
What this means for a smaller organization
You don’t need to be John Deere’s size to be a target — in fact, the breadth of this attack (100+ companies, several industries, four countries) suggests it was closer to automated opportunistic scanning than a hand-picked target list. Three practical questions worth asking about your own public attack surface this month:
- What’s actually exposed to the internet right now? Not what you think is exposed — what an external scan would actually find. Shadow IT, forgotten subdomains, and old admin panels are exactly what this kind of automated attack goes after first.
- How fast would you notice 23 hours of automated probing? If the answer is “we wouldn’t,” that’s the gap this story highlights. Agentic attacks don’t need to be fast to be effective; they need to be persistent and cheap, and the attacker has both luxuries now.
- Do your vendors and SaaS integrations get the same scrutiny as your own infrastructure? A chain of breached companies at this scale usually includes third-party and vendor-adjacent exposure, not just the headline company’s own servers.
From the field
This is new territory for almost all of us. My practical takeaway: know your public-facing domains and systems cold, and make sure the basic security measures are actually covered — not assumed. Shadow IT is close to a universal challenge across every organization I’ve worked with. The fundamentals haven’t changed; what’s changed is how cheap and persistent an attack against those fundamentals can now be.
News disclaimer: This article discusses an ongoing, independently-reported security incident. No exploitable technical details are included.