Autonomous AI agents using Cairn breach 100+ firms including John Deere

Autonomous AI agents attempted to break into more than 1,200 company websites, successfully compromising over 100 organizations, Reuters disclosed on October 19, 2026, citing a cybersecurity researcher who monitored the campaign. The intrusions, run through the open-source Cairn platform, reached farm equipment maker Deere, appliance maker SharkNinja and engine maker Cummins.

What happened

Researchers at Norforge uncovered the attacks through exposed work on Cairn, an open-source AI platform. Beginning around October 2, Fagerland said he found about two dozen instances of Cairn being used for malicious activity. One hacker set agents loose on September 25 against US, Canadian, Australian and Japanese e-commerce sites with instructions written in fewer than 100 Chinese characters. As of late last week, their agents had attempted to break into more than 1,200 sites. Fagerland estimated that the campaign, which appeared to be using a mixture of China's DeepSeek and Anthropic's Claude Code, had chewed up roughly $5,000 worth of tokens.

Impact

Reuters could not ascertain the degree to which the breaches resulted in unauthorized extraction of data. Two smaller businesses also acknowledged being compromised. Other victims listed in the Cairn data did not return messages.

Response

Deere told Reuters it had taken necessary remediation actions following the incident. SharkNinja said the hack had hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.

Lessons for security leaders

The campaign shows that a single operator with a few thousand dollars and terse instructions can direct AI agents through reconnaissance, exploitation and persistence across hundreds of public-facing sites without supervising each step. Security teams should assume internet-facing applications and vendor-operated sites will be probed continuously by automated agents rather than occasional human scans, and should prioritize patching, monitoring for anomalous automated traffic patterns, and verifying third-party vendor sites carry the same hardening as owned infrastructure. Incident response plans should account for intrusions that complete in roughly a day rather than the weeks typical of manual attacks.