Cairn AI Cyberattack: How AI Agents Breached 100+ Companies for $5,000

The scariest number in the Cairn story is not 100. It is $50.

Cairn, an open-source AI platform built for autonomous penetration testing, was used by a threat actor to breach the websites of 100+ companies with almost no hands-on work. Cytellite has profiled the campaign, infrastructure, and attack patterns. One clarification up front: Cairn itself is free. The $5,000 in the headline is what the operator reportedly spent on AI tokens to run the whole campaign.

What Cairn actually is

Cairn is a general-purpose problem-solving engine published on GitHub by a developer who posts as le1xia0. You give it a starting point and a goal. AI agents then work step by step toward that goal and post what they plan to try, and what they found, to a shared blackboard that every agent can read. Its first proving ground was autonomous penetration testing.

That last part is the catch. Third-party reviews of the project say Cairn does not check whether a target is one you are allowed to test, and that security tools such as scanners must be plugged in by whoever runs it. Cairn's author told Reuters it was not designed for attacks. The MIT AI Incident tracker records the campaign as one that reportedly ran on DeepSeek and Claude Code models. Nothing about the tool is secret, and that is exactly why these matters.

The campaign: who, when and how many

NorForge researcher Snorre Fagerland found the activity while scanning the internet for Cairn instances that had been left exposed. Reuters reported that a Chinese-speaking operator started pointing agents at e-commerce sites in the US, Canada, Australia and Japan around 25 September. Reporting published on 19 and 20 October put the scale at more than 1,200 websites targeted and more than 100 companies reached. Roughly one attempt in ten worked, and a successful intrusion took about 23 hours on average.

Three victims were named after Reuters reviewed the attacker's own records:

‍

Two honest caveats. Nobody has confirmed how much data, if any, was actually taken. And the operator still chose the targets and the goals, so this is a human using agents at scale, not agents going rogue.

How the agents got in

The operator's input was tiny. Before anything reached Cairn, targets were ranked by traffic and checked with Playwright, a browser automation framework, according to NorForge's findings as relayed by SecurityWeek. After that, a few lines of instruction were enough. The agents enumerated each site, fingerprinted it and went looking for a way in.

What they found was familiar. Aviatrix's analysis lists memcached session stores that accepted unauthorized writes, unsafe PHP object deserialization, legacy Zend Framework weaknesses and misconfigured upload endpoints. The goal was persistence: web shell uploaders planted so the operator could come back later. In one case, a single misconfigured cookie steered traffic to a vulnerable backend server.

The most human-looking move came from Reuters' reporting. After the agents failed to find a weakness in one large company's main application, they dug through records for related infrastructure, found a public-facing control panel and worked on that instead. A tired pentester does the same thing at 2 a.m. The agents just never get tired.

For threat intelligence teams, the behavior maps to a short list of ATT&CK techniques: T1190 (exploit public-facing application), T1505.003 (web shell), and T1552.001 (credentials in files). Aviatrix also found a proof of concept for the Magento flaw CVE-2026-75650 in infrastructure tied to the campaign, a sign the operator was already shopping for the next target.

The offense economy: what $50 a breach changes

Offense used to be priced in skilled hours. A good attacker could work a handful of targets a week, so plenty of companies stayed safe through obscurity rather than design. Cairn flips that. When a failed attempt costs almost nothing, the operator can try 1,200 sites and happily accept a hit rate of about one in ten.

[embed: node/d0ca107f-c65e]

Do the arithmetic and $5,000 across 1,200 sites is roughly $4 per site attempted. For CISOs, the question is no longer whether you are interesting enough to be targeted. At that price, nobody is too small to try.

What the exposed panels revealed

The Chinese-speaking operator was not alone. NorForge grouped the open Cairn panels it found into three clusters of apparently malicious activity, summarized here from SecurityWeek's report:

‍

The exposed panels also leaked hundreds of secrets, and NorForge verified that 11% of them were still valid. According to Aviatrix, some legitimate security firms had left real client engagement data on unsecured panels, too. Reuters added that one operator stole a trove of credit card data and another tried to get agents to rob a cryptocurrency exchange.

There is a bigger pattern behind this. Reuters noted that cyber intelligence firm Bitsight saw talk of autonomous agents surging on criminal forums the week before, and that AI-using criminals had been blamed for a run of hacks in South Korea and Japan.  

One Hacker. AI Agents. 100+ Companies. Just $5,000 in Estimated AI Usage.

What defenders should do this week

Nothing here needs a new product category. It needs the boring things done faster, because the other side now moves at machine speed.

1. Patch the e-commerce stack first. If you run Adobe Commerce or Magento Open Source, check Adobe's fix for CVE-2026-75650 (CVSS 10) and confirm every storefront and microsite is covered. ‍
2. Lock down session stores. Memcached and similar services should never accept unauthenticated writes from anywhere you do not control. ‍
3. Retire or isolate legacy PHP and Zend code. Unsafe deserialization in old code is exactly the kind of bug an agent can grind on for hours. ‍
4. Hunt for web shells. Look for unexpected upload forms in hidden directories and new files in web roots, then rotate any secret that could have been read from a compromised server. ‍
5. Map your third-party sites. The Cummins incident touched a vendor-run site. If a supplier hosts a page under your brand, it is part of your attack surface. ‍
6. Watch for the agent signature. Long, patient, adaptive probing from one source over many hours looks different from a classic scanner. Tune detection for it, and check your own network for exposed AI agent control panels.

At Loginsoft, we have spent 18 years in IT engineering and more than six years focused on cybersecurity, with 1,000+ zero-days discovered and 20,000+ CVEs analyzed. The pattern we keep seeing is the same one in this campaign: attackers do not need a new flaw when an old one is still unpatched.

FAQs

Q1. What is Cairn AI?

Cairn is an open-source, general-purpose problem-solving engine that coordinates AI agents toward a goal. It was validated first on autonomous penetration testing, which is also why attackers found it useful.

Q2. Did a hacker really use AI agents to breach 100+ companies?

Yes, according to NorForge's research and Reuters' review of the operator's records. A Chinese-speaking operator pointed Cairn agents at more than 1,200 websites and reached sites tied to more than 100 companies, including Deere, SharkNinja and Cummins. How much data was taken is still unconfirmed.

Q3. How much did the Cairn attack cost?

About $5,000 in AI tokens for the whole campaign, which works out to roughly $50 per successful breach. Cairn itself is free to download.

Q4. How did the AI agents get into the websites?

They exploited common web flaws: unprotected memcached session stores, unsafe PHP object deserialization and old Zend Framework code. They then planted web shell uploaders for persistent access.

Q5. Is this proof that AI can hack on its own?

Partly. The agents did the multi-hour reconnaissance and exploitation without supervision, but a human chose the targets and the goals. It is better described as one person doing the work of a team.

Q6. How can companies defend against AI agent attacks?

Patch internet-facing apps quickly, harden session stores, retire legacy PHP code, hunt for web shells, rotate exposed secrets and inventory third-party sites that carry your brand. Detection should also watch for patient, adaptive probing that looks unlike a classic scanner.