A hacker broke into John Deere and SharkNinja with an army of AI agents

Key points

• A hacker used an army of mostly autonomous AI agents to breach more than 100 websites.
• Norforge found the attacks through exposed instances of the open-source AI platform Cairn.
• John Deere, SharkNinja and Cummins were among the victims, according to Reuters.

A hacker broke into more than 100 websites using an army of AI agents that mostly operated on their own, according to the AI security firm Norforge. Reuters reports that the victims included companies such as John Deere, SharkNinja and Cummins, though Norforge did not name the targets itself.

Norforge uncovered the attacks through exposed work on Cairn, an open-source AI platform that describes itself as a general-purpose problem-solving engine. Users set a start and end point for AI agents, which document their progress, but Norforge noted the tool can also be used to orchestrate cyberattacks.

How the attacks unfolded

The hacker behind the more than 100 breaches was the most active among the exposed Cairn instances Norforge discovered, targeting companies in the US, Canada, Australia and Japan, according to Reuters. The attacker set out preferred intrusion tactics using fewer than 100 Chinese characters, and successful breaches took about 23 hours.

Norforge said it found more than 20 exposed Cairn instances that are likely malicious and is working to get them taken down.

was never a ‘hacking tool,’

— @le1xia0

What the companies said

A John Deere spokesperson told Reuters there is no indication that sensitive information was accessed. Cummins said it is investigating the report of a potential cyberattack on a website run by one of its third-party vendors.

SharkNinja said the breach affected a standalone site with product support information and that it has contained the threat. Cairn's creator, who goes by @le1xia0, said the platform was never a hacking tool and that misuse is a human decision, not a feature of the engine.