Cybersecurity company NorForge announced on October 19, 2026, that attackers are utilizing Cairn-coordinated AI agents to automatically identify website vulnerabilities and attempt to establish persistent access. NorForge's public report did not name affected enterprises; however, Reuters subsequently independently examined the attackers' Cairn activities and confirmed that sites belonging to companies such as Deere, SharkNinja, and Cummins were impacted. The newly confirmed development involves independent verification of both the investigation disclosure and the identity of affected parties, though this does not mean that every attack reported occurred within the past 24 hours.
Public Panel Exposes Scalable Attack Process
NorForge chief threat researcher Snorre Fagerland stated that the team identified more than 20 public Cairn control panels potentially associated with malicious activity. The most active group was labeled AIA0001, which used Chinese commands and ran over 1,100 attack tasks across 14 panels. Researchers determined that this group's activities primarily targeted organizations in the United States, Japan, and Australia; Reuters also reported on a Canadian e-commerce website, with the target described as e-commerce and payment infrastructure.
Cairn organizes tasks into projects that move from a starting point toward a goal, with agents writing discoveries to shared records and then determining next steps. Human operators can also provide additional prompts. NorForge observed that AIA0001 first filtered and examined shopping websites, then had agents attempt to find unauthenticated vulnerabilities and sustainable access paths. This article does not reproduce specific attack commands, addresses, or exploitation steps; what can be confirmed from public materials is that the agents performed continuous probing, path adjustment, and result compilation work rather than simply executing one-time scripts.
Success Rate, Time Duration and Independent Corporate Responses
NorForge estimated that in the different attack frameworks they observed, the average success rate was around 10%, with the remainder of tasks either failing or achieving only partial results; due to varying definitions of 'success' among groups, this ratio cannot be considered a uniform measurement. For tasks under AIA0001 that had achieved their objectives, the report gave an average time-to-completion of slightly less than 23 hours, and noted that some projects lasted more than five days. Researchers also accessed the upload endpoint recorded for a completed task to verify that at least one intrusion had indeed occurred, and additionally verified an attack chain on a major American retailer.
Reuters' independent examination of the attackers' activities supplemented corporate identities and responses. Deere stated that they had taken necessary remedial measures and there was no indication that sensitive information had been accessed; SharkNinja indicated that the affected component was an independent product support website, and the threat had been contained; Cummins stated that they were investigating whether a website operated by a third-party vendor had been subject to a cyber attack. Reuters could not determine how much unauthorized data extraction had resulted from these intrusions, and therefore could not conclude that customer data had been leaked merely based on 'website access'.
It's not straightforward to come up with solutions like that. It's not script kiddie stuff.
Snorre Fagerland, NorForge principal threat researcher · Reuters
Control Panel Breach and Model Ownership Boundaries
The exposed control panel itself also creates a second layer of risk. NorForge used TruffleHog to scan the panel data, reporting that hundreds of different types of sensitive information were discovered, with 11% still validated as effective by the scanning tools at the time of inspection. The report also noted that some seemingly legitimate red team tests left customer information on unprotected panels. The aforementioned proportion comes from NorForge's examination of samples they observed, and does not represent that all Cairn deployments or all AI security testing environments have a similar proportion of problems.
Regarding the models used and costs involved, evidence remains limited. The AIA0001 task worker name seen by NorForge was "claudecode_deepseek-v4.1-flash", and researchers cautiously explained this might indicate the Claude Code framework paired with DeepSeek V4.1 Flash; the name itself is not independent proof of the underlying configuration, nor can it be used to conclude that Anthropic or DeepSeek participated in the attack. Researchers made a rough estimate that each task consumed approximately 5 US dollars in tokens, which Reuters subsequently reported as about 5000 US dollars for the entire operation and about 50 US dollars per successful breach; NorForge explicitly stated these estimates have significant margins of error.
Disclosure Timeline and Statistical Framework
The timeline reveals that this was not an attack that suddenly began on October 19. Reuters states that AIA0001 started using agents against e-commerce websites in the United States, Canada, Australia, and Japan from September 25; Fagerland says he began discovering roughly two dozen Cairn instances used for malicious activities around October 2. NorForge publicly disclosed the complete investigation on October 19 and states that it is working with Reuters to notify potentially affected institutions and push related panels offline. Therefore, the news timeline should be based on this public disclosure rather than rewriting earlier attack incidents as occurring on the same day.
The two sets of scale figures cannot be directly added together: the over 1,100 items mentioned by NorForge refer to projects across 14 AIA0001 panels, the over 1,200 mentioned by Reuters refers to the number of websites targeted in attempted intrusions, and the over 100 refers to company websites that were breached. NorForge did not list the affected enterprises in its public report; the identities of Deere, SharkNinja, and Cummins come from Reuters' independent verification of Cairn activities. As of the time of reporting, Reuters still could not confirm the extent of unauthorized data extraction, and Cummins was still investigating a third-party vendor website; these pending issues constitute the factual boundaries of current reporting.