AI Breached More Than 100 Corporate Websites, With John Deere Among Those Taking Remediation Steps
NorForge traced a website attack campaign that relied on Cairn, a publicly available AI tool. Reuters reported that more than 100 corporate sites were breached. The companies named described the scope of the damage and where their responses stand.
AI security firm NorForge published the findings of its investigation into a website attack campaign on October 19. It is a case in which several AI agents shared what each of them discovered and pushed the attack forward together. Reuters reported that a single attacker used this approach to break into more than 100 corporate websites. John Deere, SharkNinja and Cummins were named among the companies involved. The scope of the damage and the state of the investigation differ from company to company.
How the AI Carried Out the Attack
Cairn, the tool used in the attack, is publicly available software that anyone can download and run. Give it a starting point and a goal, and multiple AI agents that handle work on their own search for a path to the solution. Each agent shares the facts it has uncovered and the action it plans to take next. The attacker that NorForge observed used this capability to find security weaknesses in websites and break in. Cairn’s developer said the tool was not built for attacks and that harmful use is not what they intended.
NorForge examined more than 20 Cairn control dashboards that had been left exposed on the open internet. In 14 of them, believed to be linked to an attacker group that issued its instructions in Chinese, the firm found more than 1,100 attack projects. It also said it confirmed cases in which intrusion tools listed as installed in the attack logs were actually running on the targeted sites. The tool allowed files to be uploaded from outside.
Attempts Against 1,200 Sites, and What It Cost
According to Reuters, this attacker’s AI attempted to attack more than 1,200 websites in the United States, Canada, Australia and Japan beginning September 25. NorForge said that among the group it monitored, projects logged as having reached their goal took an average of under 23 hours. It added, however, that a record of a goal being met does not always mean an actual breach occurred.
A NorForge researcher estimated the total model usage fees at about $5,000, or roughly $50 per successful breach. In September 2026, Gambit Security separately published its own findings on AI-driven attacks against online marketplaces. This latest investigation looked inside exposed control dashboards to observe multiple attacks as they unfolded.
Was User Data Exposed?
Reuters reported that it could not confirm how much data was taken in these breaches. NorForge did not name the affected companies in its report. Reuters separately reviewed records of the attack activity and identified John Deere, SharkNinja and Cummins. John Deere told Reuters it had completed the remediation steps required and that there was no indication sensitive information had been accessed.
SharkNinja said a standalone site containing only product support information was affected and that the threat had been blocked. Cummins said it is investigating a report of a possible cyberattack targeting a site operated by an outside vendor.
The open questions for companies and users are the true scope of the intrusions and whether information leaked. What users need to check will depend on exactly what information was affected on product support sites and on sites run by outside vendors.