Reuters and the security firm NorForge reported on October 19 that an operator who wrote the agents' instructions in Chinese pointed AI agents on the open-source Cairn platform at e-commerce sites. Reuters says the agents attempted more than 1,200 break-ins and the hacker broke into websites belonging to more than 100 companies. NorForge estimates about 10% success and about $5 per task, and Reuters reported roughly $5,000 in tokens, about $50 per successful hack. Those cost figures are estimates, not audited spend. The failures were ordinary: one documented chain used unsafe PHP deserialization and an exposed session store, and the attackers left their own control panels open without authentication. For a manufacturer or logistics firm, the practical lesson is to inventory the forgotten support, parts and campaign sites, not only the core systems.
The headline version of this story is that AI agents broke into the websites of more than 100 companies for pocket change. That count is Reuters', and NorForge independently confirmed one of the claimed intrusions. The more useful version is quieter. The agents were new. The weakness classes they hunted are long familiar, the one chain NorForge examined ran through legacy PHP components, and the people running the agents made a basic security mistake of their own.
What happened?
On October 19, 2026, Reuters and the security firm NorForge reported on a campaign built on Cairn, an open-source AI problem-solving platform. NorForge found the campaign by scanning the internet for Cairn control panels that had been left exposed. It identified more than 20 panels it assessed as likely malicious, and the most active cluster used Chinese-language instructions across 14 panels and more than 1,100 attack projects.
Cairn works in projects. Each project has a starting point and an end goal, and agents move between them by posting what they have found and what they intend to try next to a shared board that a human can also add hints to. Here, the goal was usually a web shell on an e-commerce site. The task text NorForge published asks for unauthenticated remote code execution, and lists the places to look: login SQL injection, file uploads, deserialization, authentication bypass. The target sites were checked with browser automation first, then handed to the agents.
Reuters reported that the instructions were terse, under 100 Chinese characters, and that the agents attempted break-ins at more than 1,200 sites. The platform's author told Reuters that Cairn "was not designed for hacking attacks."
Which numbers are solid, and which are estimates?
Most of the numbers repeated about this story are estimates. The table keeps each figure attached to its source and its status.
| Figure | What was reported | Source | Status |
|---|---|---|---|
| Sites attempted | More than 1,200 | Reuters | Reported |
| Sites compromised | More than 100 companies | Reuters | Reported. Reuters could not ascertain the degree to which the breaches resulted in unauthorized extraction of data. NorForge independently confirmed one claimed intrusion, a live uploader web shell on a hardware-parts vendor's site. |
| Success rate (estimate) | Around 10% on average | NorForge | Estimate, a snapshot |
| Time to goal | Typically around 23 hours for successful intrusions | Reuters, NorForge | Reported, one cluster |
| Cost (estimate) | About $5 per task, roughly $5,000 in total, about $50 per successful hack | NorForge estimate, as reported by Reuters | Estimate. NorForge had no actual token-usage data and calls the uncertainty considerable. |
| Exposed secrets | Hundreds of secrets in the exposed panel data, 11% verified valid by a scanner | NorForge | Researcher-reported scan of panel data. Not 11% of all stolen credentials. |
| Models | Worker label claudecode_deepseek-v4.1-flash | NorForge, Reuters | NorForge says the label could mean a Claude Code harness using the DeepSeek model. Not conclusive. |
What actually failed?
Three things, and none of them is a new kind of failure.
Old bug classes still work. In the one intrusion NorForge examined, the agent's own explanation described unauthorized write access to a memcached session store, combined with unsafe PHP object deserialization and an exploitable gadget chain in legacy Zend Framework components. The result was an uploader shell that NorForge confirmed was live. NorForge is clear that exploitation paths differ from target to target, so this is one documented chain, not a profile of every victim. Reuters described another case in which agents found a company's associated infrastructure, located a public-facing control panel, and after hours of trial and error reportedly used a subtle data-handling weakness to run commands on the server.
The soft edge is the site nobody thinks of as the company. Reuters named Deere, SharkNinja and Cummins among the affected companies and reported what each said. Deere said it took remediation actions and had no indication that sensitive information was accessed. SharkNinja said the incident hit a standalone site carrying only product-support information and was contained. Cummins said it was investigating a potential attack on a website operated by one of its third-party vendors. Read those statements closely. SharkNinja and Cummins described websites, Cummins' operated by a vendor, and Deere did not say which system was involved. None of the three described products, plants or core networks as affected.
The operators were careless too. NorForge found the Cairn control panels reachable without authentication. The panels exposed target lists, discovered weaknesses, account secrets and API keys, and what looked like full administrative controls for starting, stopping and redirecting projects. NorForge did not test whether those controls work without authorization. It also saw apparently legitimate red-team operations exposed the same way, which puts their clients' secrets at risk. A control plane open to the internet is a failure no matter who owns it.
What does this show, and what does it not?
It suggests that agents can make volume cheap, if the estimates hold. A success rate of around 10% sounds poor until the estimated cost per attempt is a few dollars and the work runs unattended. It also shows commodity tooling: NorForge found browser automation, a PHP gadget-chain generator, and standard scanners in one worker's folder.
It does not show new zero-day techniques. It does not show that any AI vendor enabled the attack or failed at safety. NorForge says only that the worker label could mean a Claude Code harness using a DeepSeek model. It does not show state sponsorship: NorForge saw financial motives and no obvious state activity, and "Chinese-speaking" describes the language of the instructions, not a nationality. And it does not show that products, plants or core systems at the named companies were affected, or that all 100 or more victims shared one flaw.
It is also the mirror image of an incident we decoded earlier. In the Hugging Face case, a lab's own agents went outside their sandbox. Here the agents were aimed at other people's sites on purpose. Both come down to the same question: who can start, stop and constrain an agent. And the defensive side of the same agent traffic is in how banks are blocking agents.
What should you check first?
These are our recommendations, drawn from the weaknesses in the reporting. They are general hygiene, not a claim that any single step would have stopped this campaign.
- List every internet-facing site under your brand or run by a vendor for you, including support microsites and campaign pages, and give each an owner.
- Retire or patch legacy PHP stacks. Treat deserialization of user-controlled data as a defect, and check how old your framework components are.
- Keep session stores private. A memcached or Redis instance that an outsider can write to is a path to your application.
- Watch for new files in web roots, and for upload handlers that accept executable types. An uploader shell was the payload NorForge saw.
- Shorten the life of secrets. Rotate on a schedule and prefer short-lived, narrowly scoped credentials. We unpack one vendor's approach in our teardown of IBM Agent Identity and Vault.
- If you run agents yourself, including security tools, put the control panel behind authentication, keep secrets out of task text, set spend limits and keep a kill switch. Our production agent architecture notes cover the related guardrail and monitoring practice.
Agents may now be cheap enough for attackers to use at volume. That raises the baseline for everyone who builds with them. Scoped credentials, an authenticated control plane, spend limits and traces are launch requirements, not hardening for later. More on how we build them is in our production agent work.
If you are putting agents near operational systems, show us the process and we will tell you where the control plane and the credentials need to sit.