AI Agents Hit 1,200+ Sites via Cairn: What Reuters Verified and What Is Estimated

Reuters reports that a Chinese-speaking operator used AI agents, run through an open-source platform called Cairn, to attempt more than 1,200 e-commerce sites and break into more than 100 companies' sites. The source is NorForge researcher Snorre Fagerland, whose report went to Reuters ahead of publication. Several headline numbers are estimates, so this post sorts what is confirmed from what is not.

TL;DR

What is reported and how solid it is

Reported by Reuters from Fagerland's research:

• Starting around October 2, Fagerland found about two dozen inadvertently exposed Cairn instances being used for malicious activity, which let him watch the operator's agents.
• The operator gave terse instructions, under 100 Chinese characters, and from September 25 targeted e-commerce sites in the US, Canada, Australia and Japan.
• By late last week agents had attempted more than 1,200 sites. Successful intrusions typically took about 23 hours of probing.
• In one case, agents found no flaw in a large company's main application, searched records for related infrastructure, found a public-facing control panel with a subtle weakness in data handling, and after hours of trial and error got the server to execute commands.

Independently checked by Reuters: it reviewed the operator's Cairn activity to identify victims. Deere said it took "necessary remediation actions" with "no indication that sensitive information was accessed." SharkNinja said a standalone product support site was hit and contained. Cummins said it was investigating a potential attack on a site run by a third-party vendor.

Estimates and unknowns:

• The roughly $5,000 in tokens (about $50 per success) is Fagerland's estimate, not an audited figure, as IBTimes also reports.
• The count of successful breaches is not stated in the article beyond "more than 100."
• The DeepSeek and Claude Code mix is described as apparent; the article carries no comment from Anthropic or DeepSeek.
• Whether data was stolen is undetermined. The operator is known only by activity, and Cairn's author says the platform "was not designed for hacking attacks" and did not answer Reuters.

What Cairn is and why exposed instances matter

Reuters describes Cairn as "an open-source AI problem-solving platform popular with hackers." Gambit Security, whose September report on a separate campaign is summarised by The Next Web, describes it more narrowly as an autonomous penetration-testing agent that carried out attacks from start to finish, running on DeepSeek V4.1 Flash in that case. The Next Web notes that it had not independently verified Gambit's findings, so treat that description as the vendor's.

The detail that made the NorForge observation possible is mundane. Fagerland found his Cairn instances by scanning the web for ones that were exposed, and exposure of that kind, in his account, let him watch the operators' agents at work. That is how he could "quietly peer over the cybercriminals' shoulders," in Reuters' words. It is also a reminder for anyone who runs an agent platform of their own: a service on a public address can be found by scanning, as it was here.

Cairn's author, who posts as "le1xia0", told the public on X that the platform "was not designed for hacking attacks," and that misuse "is not my intention." Neither Reuters nor IBTimes reports any action taken against the project. Whether a general-purpose agent platform should carry safeguards against misuse is a policy question this post does not try to settle.

How the observed intrusion worked, step by step

Reuters gives one case in enough detail to follow the agents' reasoning. The target was a large company, and the sequence was:

1. The agents attacked the company's main public-facing application and found no usable weakness.
2. Instead of stopping, they went through digital records to find infrastructure associated with the company. Reuters does not say which records, so the exact source of that discovery is unknown.
3. They located a public-facing control panel, a different system from the hardened main application.
4. They found what Fagerland called a "subtle weakness" in how the panel processed data.
5. After hours of trial and error, they reportedly used that weakness to make the server execute malicious commands.

The pattern is the interesting part, not any single flaw. A well-defended front door pushed the attacker toward the side doors: a vendor-run site, a control panel, a support microsite. Reuters' own victim list fits that pattern. SharkNinja said the affected site was standalone and held only product support information, and Cummins said the site was run by a third-party vendor. Neither is the company's primary application.

The cost of the trial and error is what changes. Fagerland said successful intrusions typically took around 23 hours of probing and estimated about $50 in tokens per success. A human tester would not usually spend a day on a single low-value support site. At those prices, an agent can.

Reuters does not name the control-panel product, the weakness or a CVE, so there is nothing to patch against from this report alone. The practical question for defenders is therefore about exposure, not a version number.

Earlier reporting on the same tooling

This is not the first reported campaign involving Cairn, which helps put the numbers in context.

Gambit Security's report of September 22, as summarised by The Next Web, described an operator who combined three open-source agents. Strix scanned for weaknesses, Cairn carried out attacks, and Hermes coordinated the campaign. Gambit said it recovered the operator's staging server and rebuilt the campaign from logs, stolen data and compromises it verified on live sites. Its figures include at least 27 companies compromised, more than 600,000 card records stolen from two of them, and card skimmers hidden in places such as JavaScript libraries and Google tags. The operator's model account spent $7,005.71 over four weeks, and Gambit estimated the whole campaign at $12,000 to $18,000, or $25.46 per completed scan on average. At one retailer, Gambit reported that the agents' cleanup routines dropped 180 database tables, including backups the victim's administrators had made. Those are Gambit's figures, reported by a secondary outlet.

Reuters also cites an August Gambit finding that Russian-speaking extortionists used a commercial coding-agent tool to break into seven organizations. We have not fetched that report and cite it only as Reuters presents it.

For the wider picture, Reuters cites Bitsight's observation that discussion of autonomous agents is surging on criminal forums. Bitsight's own write-up, published October 15, analysed thousands of posts across 16 underground communities from February through August 2026. It reports a 45% rise in AI-related discussion and a 49% drop in ransomware mentions over the same window, and notes that keyword counts are an imperfect measure.

Taken together, these reports describe the same pattern from different angles: cheap agents, short instructions, many targets. They do not show that every campaign succeeds. Gambit and NorForge both observed the operators they were able to see.

What we still do not know

• How many intrusions succeeded. Reuters says "more than 100"; Fagerland's report does not name victims.
• What was taken. Reuters could not establish how much data left. Deere reported no indication that sensitive information was accessed; the other statements are silent on it.
• Which models did the work. The mix of DeepSeek and Claude Code is described as "apparent." No provider has commented in the coverage we read.
• Whether the operator is still active. Fagerland's observation covers roughly September 25 to mid-October.

What this means if you run AI coding agents

The defender takeaways are about the attacker's economics: persistent, cheap, patient probing. A target that survives a human's afternoon of scanning may not survive 23 hours of an agent iterating on error messages. This matches Wiz's account of AI-run cloud intrusions and the South Korea bank case.

• Inventory public-facing admin panels, vendor-run microsites and support sites. The reported breach path ran through one.
• Keep exposed internal tools patched and behind authentication.
• Alert on long, persistent error-driven probing of a single endpoint, not just bursts.
• If you build tools that reach agents' hosts, don't expose agent dashboards: Cairn instances left on the open web are how this was observed.
• Treat agent-run probing as routine, not exceptional.
• Providers do act on misuse: see Anthropic's September threat report.

How to turn this into checks you can run this week, using only what the reporting supports:

• List what is public. Make a list of every hostname and admin or control-panel address you or your vendors expose to the internet, including microsites and support portals. The reported path ran through a control panel that was not the main application.
• Ask vendors the same question. Cummins' statement concerned a site run by a third party. Contracts rarely say who patches a marketing or support site; ask.
• Put authentication in front of panels. An admin interface that is reachable by anyone is a candidate for patient automated probing, whatever the flaw turns out to be.
• Look at logs for duration, not volume. The reported intrusions took about 23 hours of "poking and prodding." A rate limit tuned for bursts will not notice a single client sending a modest, steady stream of malformed requests to one endpoint for hours. Compare your alerting with that shape.
• Check how your own agent dashboards are exposed. If you run an agent platform, confirm it is not reachable from the open internet without authentication. This is the exact condition that let Fagerland watch the operators.
• Keep patching current. The report names no CVE, so there is no single fix, but a "subtle weakness in the way it processed data" is the kind of bug routine updates remove.

The attack also runs the other way for readers who use coding agents themselves. If an operator can aim Claude Code or a similar tool at other people's sites, a stolen or leaked API key lets someone else spend your budget on it. Our post on AI API key theft covers that route, and the September Anthropic threat report shows how a provider describes misuse it detects.

What Beam can and cannot do here

Beam watches agents on your own machine; it would not see an attacker's agent hitting your web server, and it cannot tell you whether a vendor's support site is exposed. What it offers is the other direction: if you run Claude Code or Codex, hooks can flag credential exposure and destructive commands in tool calls, with deny on PreToolUse. That is hook-based and heuristic, not a kernel sandbox, and it fails open without a cached policy. See how Beam works.

Frequently asked questions

What exactly was verified?

Reuters reports that NorForge researcher Snorre Fagerland observed Cairn instances used by a Chinese-speaking operator, and that Reuters independently reviewed Cairn activity to identify victims. Deere, SharkNinja and Cummins responded to Reuters about affected sites.

Is the $5,000 cost figure confirmed?

No. It is Fagerland's estimate of token spend, about $50 per successful hack, and the article does not state an exact count of successful breaches.

Was Claude Code really used?

Reuters says the campaign appeared to mix DeepSeek and Anthropic's Claude Code. The article included no response from Anthropic or DeepSeek, so treat the model attribution as the researcher's assessment.

Was data stolen?

Reuters could not determine to what degree. Deere said it had no indication sensitive information was accessed, and SharkNinja said the hit site was a standalone product support site and was contained.

What should defenders do?

Inventory and patch public-facing control panels and third-party vendor sites, assume probing runs around the clock, and watch for repeated low-and-slow attempts that persist for hours on one target.

Details reflect Reuters' reporting as of October 19, 2026 and the other sources linked above, checked October 20, 2026 and may change as more is confirmed.