A rare look inside criminal AI operations has come from the criminals' own carelessness. In a report published on Monday, October 19, 2026, the security company NorForge said it found more than 20 publicly exposed control panels for Cairn, an open-source platform that coordinates AI agents toward a goal, that were likely being used for malicious hacking. Because the panels had no access controls, researcher Snorre Fagerland could watch the attackers pick targets and follow the agents as they probed, exploited and planted footholds on victim websites.
Reuters, which received the report before publication, independently reviewed the activity of the most prolific operator and identified victims. It reported that a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere, appliance company SharkNinja and engine manufacturer Cummins. Since September 25 the operator's agents had attempted to break into more than 1,200 sites, Reuters said. It added that it could not establish how much data, if any, was taken.
The companies played down the impact. Deere told Reuters it had taken "necessary remediation actions" and had no indication that sensitive information was accessed. SharkNinja said a standalone product support site was hit and the threat contained, and Cummins said it was investigating a potential attack on a website run by a third-party vendor.
NorForge groups the activity into clusters. The largest, labelled AIA0001, used Chinese-language instructions across 14 panels and more than 1,100 attack projects, aiming for persistent access to e-commerce and payment infrastructure in the United States, Japan, Australia and Canada. Its tasks were fed in automatically, ranked by traffic and pre-tested with browser automation, and carried out by a worker named claudecode_deepseek-v4.1-flash, which NorForge reads as a Claude Code harness driving China's DeepSeek 4.1 Flash model. A second, English-language cluster of 10 panels focused on stealing card and cryptocurrency data using workers labelled pi_openrouter_deepseek, and a third, lower-confidence panel held 59 projects.
The economics are what make the campaigns alarming. NorForge estimates the average Cairn task cost about 5 dollars in model tokens, though it stresses the figure is highly uncertain and long projects could exceed 100 dollars. Reuters, measuring per outcome, put the Chinese-speaking operator's spend at roughly 5,000 dollars in tokens, or about 50 dollars per successful hack, using a mix of DeepSeek and Anthropic's Claude Code. NorForge assessed the average success rate at around 10 percent, with the leading cluster reaching its goal in a little under 23 hours on average.
The exposure cuts both ways. Running the secrets scanner Trufflehog over the leaked panel data, NorForge found hundreds of credentials, 11 percent of them verified as valid, along with what appeared to be full administrative controls to start, stop and redirect the agents. The firm said some apparently legitimate red-team engagements were exposed the same way, putting those clients at risk too. It did not publish the panel addresses, saying many were still live and held sensitive data.
The finding lands amid mounting concern about autonomous attacks. Fagerland, who has worked in cybersecurity for nearly three decades, said he had assumed hacker-run agents would still need human supervision and now sees that they do not. NorForge noted that in September the firm Gambit Security documented an AI-agent spree that breached 25 companies and exposed at least 600,000 card records. NorForge said it cooperated with Reuters to notify victims and is trying to get the offending panels taken down. Cairn's author, who goes by "le1xia0", told Reuters the platform was not designed for hacking and that misuse was not their intention.