Norforge says hacker compromised more than 100 sites with AI agents

AI security firm Norforge says it identified a hacker who used the open-source Cairn platform to coordinate largely autonomous agents. Norforge’s analysis says the agents tried to breach more than 1,200 websites and compromised more than 100; Reuters identified pages linked to John Deere, SharkNinja and Cummins among the targets. The attacks reportedly took about 23 hours each, and Norforge found more than 20 exposed Cairn instances that were likely malicious.

Xataka reports that the attacker’s instructions were fewer than 100 Chinese characters long and estimates, based on Snorre Fagerland’s analysis, that the campaign consumed about $5,000 in tokens — roughly $50 per compromise. Cummins told The Verge it is investigating a potential attack on a website operated by a third-party vendor; John Deere told Reuters there was no indication that sensitive information was accessed, while SharkNinja said the incident affected a standalone site and had been contained. Norforge is working to take down the malicious instances.