How Exposed Cairn Instances Revealed an AI-Agent Hacking Campaign

When honeypots became witness boxes

Researchers at NorForge, working with reporting from Reuters on October 19, 2026, described how exposed instances of the Cairn security platform inadvertently documented a sprawling campaign in which autonomous AI agents compromised more than one hundred production websites. Snorre Fagerland, a prominent threat intelligence figure associated with the findings, helped contextualize the operation as a shift from human-led website defacement to machine-led intrusion at commodity prices—often near fifty dollars per successful hack when cloud inference and agent tooling costs were amortized.

Cairn, deployed by organizations seeking to monitor attack surface and deception technology, became a lens because misconfigured or internet-facing dashboards leaked telemetry about what attackers attempted and where they succeeded. Instead of only catching script kiddies, the data set revealed coordinated use of frontier models and coding agents to chain reconnaissance, vulnerability identification, and payload deployment.

The victim set: brands consumers trust

Breaches cited in the coverage included household industrial and consumer names: Deere, SharkNinja, Cummins, and dozens of others spanning retail, manufacturing, and logistics. These are not obscure crypto startups; they are companies whose logos appear on farm equipment, kitchen appliances, and heavy machinery. The attackers were not primarily interested in stealing customer credit cards from checkout pages—though some incidents involved injecting SEO spam and malicious redirects—but in establishing persistent footholds that could be resold or repurposed.

For security teams at those brands, the incident is a reminder that content management systems, marketing microsites, and forgotten subdomains inherit the same risk as core e-commerce stacks. Agents scale the enumeration of such assets faster than human penetration testers.

Economics of the fifty-dollar hack

Fagerland's framing emphasized unit economics. An operator can rent GPU time, invoke low-cost models such as DeepSeek variants for planning, and delegate implementation to coding agents in the Claude Code class for a few dollars per attempt. When spread across thousands of targets, successes cost tens of dollars each—far below traditional ransomware payouts. The business model resembles affiliate fraud more than nation-state espionage: volume, automation, and resale on underground markets.

That price point matters for defenders. If offense is cheap, blocking single indicators is insufficient. Organizations need continuous attack surface reduction and deception that wastes agent cycles, raising attacker costs.

DeepSeek plus Claude Code in the toolchain

The campaign reportedly combined models from different vendors—DeepSeek for certain reasoning or translation steps and Anthropic-flavored coding agents for producing exploit scripts and web shell payloads. Mixing vendors may evade single-vendor safety classifiers or simply reflect attacker preference for cost and capability per task. It also complicates policy responses that focus on banning one provider.

None of the models were necessarily used in ways their terms of service permit. The reporting describes misuse via stolen API keys, compromised developer laptops, and open-weight deployments without guardrails. Security researchers caution against interpreting the story as proof that any one model is uniquely dangerous; rather, agent orchestration lowers skill floors.

Twelve hundred sites attempted

NorForge and Reuters noted on the order of twelve hundred sites probed or attacked during the observation window, with a double-digit percentage yielding some form of compromise. Conversion rates that would be unacceptable in marketing are lucrative in cybercrime when marginal cost is near zero. Agents do not sleep, do not hesitate at legal risk, and can parallelize across geographies until rate limits kick in.

Cairn's visibility into this wave was accidental—a byproduct of deployments that should not have been internet-exposed. The irony reinforces a meta-lesson: security products themselves become targets when misconfigured.

Tactics, techniques, and procedures

According to the disclosures, agents performed credential stuffing assisted by OSINT, scanned for outdated plugins, generated tailored PHP and JavaScript injections, and created hidden administrator accounts. Some flows used multi-step plans stored in agent memory, revisiting sites days later to exfiltrate analytics tokens or insert cryptocurrency drainers on niche landing pages.

Traditional WAF rules struggled because payloads were unique per site, crafted on the fly. Signature-based detection lagged; behavioral analytics and outbound traffic monitoring caught some intrusions only after SEO spam appeared in search results.

Why enterprises missed the wave

Many affected organizations lacked unified logging between marketing CMS instances and corporate SIEMs. Third-party agencies with CMS admin rights multiplied credential sprawl. Bug bounty programs focused on primary domains, not long-tail campaign URLs. Agents exploited the gap.

Reuters quoted analysts noting that incident response retainers were activated only after external researchers notified brands—classic signs that detection debt outpaced AI-enabled offense.

Implications for AI governance

The campaign lands amid corporate enthusiasm for deploying their own agents inside firewalls. CISOs now face symmetric threats: external agents attacking public sites while internal copilots touch sensitive data. Microsoft's Project Perception and similar initiatives aim to govern internal agents, but external autonomous attackers remain an open problem.

Vendor risk teams should revisit contracts with AI API providers, monitoring for anomalous usage that could indicate employee keys stolen or shadow IT experiments.

Legal and communications fallout

Public companies among the victims may face securities disclosure questions if materiality thresholds are met. Consumer brands risk reputational harm even when shopper data was untouched—search poisoning and malware redirects erode trust. Deere and SharkNinja, named in coverage, will likely run parallel investigations with law enforcement and PR teams crafting nuanced statements.

Defensive recommendations from the research

NorForge's public materials emphasize closing exposed admin panels, enforcing MFA on CMS users, segmenting marketing sites from corporate identity, and deploying honeypots intentionally rather than accidentally. For AI-specific defenses, rate limiting on login endpoints, CAPTCHA on admin paths, and canary tokens in config files can trip agentic scanners.

Threat intelligence sharing through ISACs should include prompt patterns and tool-call sequences when legally permissible, so defenders update WAF ML models.

Academic and Stackademic context

For readers studying cybersecurity architecture, the incident is a case study in emergent threat models. Textbooks that still center on SQL injection by manual testers need updating. Courses should cover how LLM agents plan attacks, how to red-team agent defenses, and how to measure mean time to detect machine-speed intrusions.

Connection to federal policy moves

The same week, U.S. Department of Homeland Security orders on DeepSeek illustrate government concern about foreign model supply chains. The Cairn campaign shows that domestic and commercial models also enable harm when misused. Policy debates must avoid simplistic bans and focus on accountability for operators, logging, and critical infrastructure hardening.

Future scenarios

If agent costs continue falling, defenders should expect simultaneous campaigns against thousands of small businesses—dentists, regional news, schools—whose IT is outsourced and porous. Aggregators may sell access to compromised sites as SEO boosters or cryptocurrency promotion channels.

Conversely, defensive agents—if governed properly—could patrol owned domains faster than human teams. The arms race is symmetric.

Synthesis

Exposed Cairn instances gave NorForge and Reuters a rare window into an AI-agent hacking campaign attributed in analysis to Snorre Fagerland's team, with more than one hundred breaches including Deere, SharkNinja, and Cummins, roughly fifty dollars per hack economics, DeepSeek and Claude Code in the toolchain, and twelve hundred sites attempted. The story is a cybersecurity wake-up call framed in commodity pricing and household brands.

Organizations cannot assume that AI agents are only productivity tools for employees. They are also weapons for criminals who price attacks like SaaS microtransactions. Closing that gap requires architecture, not slogans—and perhaps turning Cairn-style visibility from accident into deliberate strategy.