In one of the first well-documented cases of a lone cyber criminal deploying fully automated AI agents successfully, a hacker out of China has breached about 100 organizations using the Cairn platform to coordinate DeepSeek and Claude Code activity.
The hacker is not the only one abusing Cairn in this way, but is the most “prolific” and successful of the bunch that have been observed by researchers thus far. Their successful breaches thus far include John Deere and Cummins among other business targets, and at an estimated cost of only about $50 worth of tokens per breach.
Chinese hacker’s campaign demonstrates malicious deployment of AI agents is taking place
The research comes from security firm NorForge and focuses on tracking down malicious deployments of the Cairn open source penetration testing platform. There are several similar platforms that hackers looking to harness AI agents for malicious activity make use of, but Cairn has a web-based interface that for whatever reason often goes unsecured by its users.
In plumbing through these unsecured instances, the researchers found over 20 panels that were likely being used for malicious activity. Some of these are “clusters” that appear to coordinate with each other on attacks, the largest of these groups running some 1,100 attack projects at the time of the research. These clusters also post instructions in Chinese and have a heavy focus on targets in the US, Australia and Japan.
One particularly productive hacker is responsible for most of the headline-grabbing activity. This user has been traced to 100 successful breaches, including Fortune 500 outfits John Deere and Cummins and popular home appliance company SharkNinja. However, as the researchers note, they personally did little work beyond leaving instructions for AI agents.
It was not only light work, but relatively inexpensive. The researchers found evidence that the hacker is primarily using the recently-released DeepSeek 4.1 Flash model, harnessed by Claude Code. Costs to use this model can vary by demand, but given that each breach took an average of about 23 hours the researchers estimate the cost per attack at about $50 USD at the low end and likely not much more than $100 USD at most.
AI agents uncovering “subtle” attack vectors without supervision
Principal researcher Snorre Fagerland notes that the low price is also not necessarily buying low-quality hacking. He outlines one instance in which the AI agents relentlessly probed a target’s digital records to find a public-facing control panel, then engaged in hours of trial-and-error testing to find a way to leverage its data processing method to force it to execute malicious code. Fagerland warns the AI agents are not simply digital “script kiddies” and are capable of “subtle” attack approaches like this without any input or direction from a human user. The agents also probe each target for unique vulnerabilities and come up with unique approaches each time.
However, there have not been any reports of substantial damage by the AI agents as of yet. The original research did not name the victims, but follow-up reporting by Reuters and others traced the attacks back to the named companies. John Deere has acknowledged that a breach took place, but said that no sensitive information was accessed and it has since taken steps to fix it. SharkNinja also acknowledged the breach but said that it did limited damage to a product support site and had been contained. Cummins has said that it is still investigating the incident.
The exposed panels also included exposed credentials harvested from some of the targets. Testing by the researchers indicated that 11% remained valid. Other malicious activity clusters found at Cairn are communicating in English but targeting African commerce sites, providing some indication of the physical location of the operators.
Automation of AI agents to perform cyber attacks can be traced back to at least late 2025, with Chinese hackers observed jailbreaking Claude Code and using it to automate the vast majority of a campaign that targeted about 30 different organizations around the world. Completely automated attacks are relatively new, however. The first recorded was in July of 2026, when various Taiwanese government agencies and energy sector companies were attacked by a swarm of eight AI agents believed to be operating without human supervision over a period of four days.
Those prior incidents were linked to more advanced attackers with likely government backing, however. This new research represents a new step forward, one in which smaller-scale profit-seeking cyber criminals are able to leverage similar AI capability at a relatively affordable cost. The price of tokens may still deter rank amateurs and wannabes, but these new tools will very likely provide a substantial boost to organized ransomware and extortion gangs that already have resources at their disposal.
Justin Beals, CEO & Founder of Strike Graph, notes that organizations of all sizes need to take this new development seriously: “Fifty dollars per successful breach is the number every security leader should bring to their next budget meeting. This research gives us hard evidence of what one person with commercially available AI tools can do. A single hacker with a few thousand dollars in tokens now operates like a gang of 100. The agents spent about 23 hours probing each target until something gave, and when the front door held, they went looking for associated infrastructure and found a side door. That kind of patient, methodical work used to take a full pen testing team.”
“Most organizations test their defenses once a year and assess their vendors with questionnaires … Security teams need to turn the same tools on themselves,” Beals adds. “The AI tooling is stable enough now to build defensive agents that continuously probe your external footprint and your vendors’ footprint, the way these attackers do. Start with everything internet-facing that carries your name, including what vendors host for you. If you aren’t running that loop, someone else already is.”
