Overview
A hacker successfully compromised more than 100 websites — including high-profile industrial and consumer brands John Deere, SharkNinja, and Cummins — by deploying an army of AI agents operating with minimal human supervision. The campaign was uncovered by AI security firm Norforge, which discovered exposed workspaces on Cairn, an open-source “general-purpose problem-solving engine” that allows users to direct AI agents from a defined start point to an end goal while logging progress automatically.
This incident represents a watershed moment in offensive AI: a single threat actor leveraging agentic infrastructure to achieve breach scale that would previously have required a coordinated team.
Technical Analysis
Cairn’s architecture is designed for legitimate autonomous task execution — users specify objectives and the platform’s agents decompose and execute sub-tasks independently. Norforge found that the attacker exploited this design by configuring agents with offensive objectives (e.g., credential discovery, vulnerability scanning, and exploitation) and setting target websites as the end-point goals.
Key characteristics of the attack method:
- Low human-in-the-loop requirement: The AI agents carried out reconnaissance, exploitation attempts, and post-access actions with minimal operator intervention.
- Exposed Cairn instances: The attacker’s activity logs were inadvertently exposed through misconfigured Cairn deployments, enabling Norforge to reconstruct the campaign.
- Scale through automation: The same agentic loop was reused across targets, enabling rapid horizontal scaling to 100+ victims.
This is consistent with a class of attacks where general-purpose agentic frameworks are repurposed as offensive automation pipelines — requiring only goal specification from the human operator.
Framework Mapping
MITRE ATLAS:
AML.T0103 – Deploy AI Agent: Core technique; the attacker deployed agents as the primary attack vector.AML.T0086 – Exfiltration via AI Agent Tool Invocation: Agents likely used tool calls to access and extract data from target systems.AML.T0084 – Discover AI Agent Configuration: Norforge’s discovery via exposed Cairn configs highlights the dual-use risk of this technique.AML.T0047 – AI-Enabled Product or Service: Cairn itself is the AI-enabled platform weaponised in this campaign.
OWASP LLM Top 10:
LLM08 – Excessive Agency: The Cairn agents operated with broad permissions and minimal human oversight, exemplifying the excessive agency risk.LLM07 – Insecure Plugin Design: Tool integrations within Cairn enabled agents to interact with external systems without adequate controls.
Impact Assessment
The breach affected companies across agriculture, consumer appliances, and heavy industry — sectors where operational data, proprietary designs, and supply chain credentials carry significant value. With 100+ confirmed victims, the blast radius of this single campaign is substantial. The low barrier to replication (Cairn is open-source) means similar attacks are likely to proliferate.
The incident also validates long-standing concerns that agentic AI systems, if misconfigured or left unsecured, can be turned into force multipliers for offensive operations.
Mitigation & Recommendations
- Restrict Cairn and similar agentic platform deployments behind authentication and network segmentation; never expose agent workspaces to the public internet.
- Implement behavioural anomaly detection tuned to multi-step, low-latency automated access patterns characteristic of agent-driven attacks.
- Enforce least-privilege tool permissions within any agentic AI framework — agents should not have broader system access than strictly necessary.
- Monitor threat intelligence feeds for mentions of your organisation’s assets in exposed AI agent logs or open-source orchestration platforms.
- Conduct purple-team exercises simulating agentic attack scenarios to validate detection and response capabilities.