Cairn AI Agents Breach 100+ Companies Including John Deere, SharkNinja

What makes this campaign notable is not sophistication but arithmetic. A single operator gave AI agents fewer than 100 Chinese characters of instruction - essentially an order to find a way to run code on each target and plant a web shell - then let the agents handle reconnaissance and exploitation unsupervised ^[3]. From that minimal starting point, the agents probed over 1,200 e-commerce sites across the US, Canada, Australia, and Japan and successfully breached more than 100 of them ^[1]. The cost per successful breach worked out to roughly $50 in AI tokens, with an average of about 23 hours of agent effort per successful intrusion and a success rate around 10% across the observed Cairn-linked activity ^[1]. At that price and timescale, mass-probing thousands of targets stops being a labor-intensive endeavor and becomes a background process a single person can set running and walk away from.

The campaign was not caught through a victim's intrusion-detection system or a law-enforcement tip - it was caught because the operators left their own command infrastructure open to the public internet. Fagerland found the Cairn control panels by scanning for exposed instances, eventually cataloguing 20+ panels and reconstructing the operation from the activity logged inside them ^[2]. Those same panels leaked hundreds of credentials and API keys, 11% of which were later verified as still-valid secrets using the Trufflehog scanner ^[1]. Fagerland framed this directly as a tradeoff the attackers made for speed: "The attackers are compromising their own operational security in the rush for quick results" ^[2]. The same low-friction tooling that let one operator run a 1,200-site campaign for a few thousand dollars also made it trivially easy to leave the entire operation's internals sitting in the open.

Rather than a single model doing everything, the attack chain split work across specialized agents and providers. NorForge's own telemetry read the primary worker string as Claude Code paired with DeepSeek's low-cost V4.1 Flash model ^[1]. Other reporting on the same tool family described a three-agent division of labor: a scanning agent (Strix) running on Z.ai's GLM 5.2 or DeepSeek V4 Pro, an exploitation agent (Cairn itself) running on DeepSeek V4.1 Flash, and an orchestration agent (Hermes) running on Anthropic's Claude Opus 4.6 ^[1]. Fagerland's reaction to this architecture was less about any single capability and more about the trajectory it represents: "The development in this field is astounding. It's a new world now" ^[3]. The notable shift isn't that one frontier model can hack a website - it's that cheap, mid-tier models chained together under a cheap orchestrator can replicate what used to require a skilled human operator end to end.

NorForge's investigation did not describe a single actor working in isolation. Of the 20+ exposed Cairn panels it catalogued, researchers grouped the activity into three separate clusters: a 14-panel, Chinese-language cluster (AIA0001) hosting more than 1,100 attack projects via AS56594 (Cgi Global Limited) and targeting US, Japan, and Australian e-commerce and payment infrastructure; a 10-panel, English-language cluster (AIA0002) on Vultr infrastructure (AS20473) focused on merchant payment services and cryptocurrency theft; and a smaller, single-panel cluster (AIA0003) running 59 projects ^[2]. That NorForge needed three separate categories to describe what it found suggests the Deere/SharkNinja/Cummins campaign was not the only operation running on Cairn's infrastructure at the time - the same open-source tooling was showing up across multiple, differently-configured clusters simultaneously.

The technical story becomes a corporate-accountability story once the named victims respond. Deere told Reuters there was no indication sensitive information was accessed; SharkNinja said the incident hit a standalone product-support site and that the threat was contained; Cummins said it was investigating a possible attack on a website run by one of its vendors ^[4]. Underneath those individual statements sits a larger risk: the campaign was connected to the theft of 600,000+ unexpired credit card records from two companies, with persistent web shells planted to maintain access to shop and payment systems ^[2]. For most of the named companies the direct damage looks contained so far, but the pattern - a near-$50 cost structure, minimal human oversight, and an open-source tool anyone can download - suggests the exposure these companies faced is not unique to them.