A hacker breached over 100 sites including John Deere, SharkNinja and Cummins. The attacks used AI agents that operated mostly on their own. The hacker targeted firms in the US, Canada, Australia and Japan. Successful breaches took about 23 hours each. Norforge found more than 20 exposed Cairn instances likely used for attacks. Cairn is an open-source AI platform for task automation. The hacker outlined intrusion tactics in under 100 Chinese characters. Cummins is investigating a potential breach on a vendor site. John Deere reported no sensitive data was accessed. SharkNinja contained a breach on a product support site. Norforge is working to take down the malicious instances. Cairn’s creator denies it is a hacking tool.
What changed
Attacks required direct human control and manual execution.
What it unlocks
Automated large-scale breaches with minimal human oversight.
- 100+ websites breached
- 23 hours per successful breach
- 20+ exposed Cairn instances
What you need to act on it
- exposed Cairn instances
- AI agents configured with intrusion tactics
Sources