Autonomous AI agents breach John Deere and SharkNinja

Security firm Norforge has uncovered a major cyberattack campaign where a single actor utilized autonomous AI agents to breach more than 100 websites across the US, Canada, Australia, and Japan. High-profile victims include John Deere, SharkNinja, and Cummins. The threat actor orchestrated these intrusions using Cairn, an open-source general-purpose problem-solving engine created by developer @le1xia0.

Norforge identified over 20 exposed Cairn instances that appear likely malicious, with the primary attacker operating the most active deployment. The hacker initiated complex cyberattacks by laying out preferred intrusion tactics using fewer than 100 Chinese characters. Once configured with start and end parameters, the AI agents executed the operations with minimal human oversight, completing successful breaches in approximately 23 hours.

Targeted organizations are currently assessing the impact. Cummins spokesperson Melinda Koski confirmed the firm is investigating a potential attack on a third-party vendor site, while SharkNinja stated its breach was contained to a standalone product support domain. John Deere reported no indication that sensitive information was accessed. Meanwhile, Norforge is working to take down the malicious setups, while @le1xia0 clarified that Cairn was never meant as a hacking tool, stating that misuse remains a human decision.

For cybersecurity professionals, this campaign marks a clear turning point in how threat actors leverage modern AI frameworks. By automating the end-to-end execution of intrusion workflows, agentic systems drastically lower the skill and labor requirements needed for enterprise breaches. Security teams must now adapt to defending against persistent, machine-speed attacks that can probe networks around the clock without direct human guidance.