Norforge: Hacker used AI agents to breach more than 100 sites
For the CISO of a regional bank
A hacker used AI agents running on the open-source Cairn platform to break into more than 100 websites, according to findings from the AI security firm Norforge, reported by The Verge on Oct. 19.1
Norforge found the attacks through exposed work on Cairn, which describes itself as a "general-purpose problem-solving engine" where users set a start and end point and the agents document their progress.1 Norforge noted that hackers can use Cairn to orchestrate cyberattacks using AI agents, according to The Verge.1
Norforge does not name the targets; Reuters reports the victims included John Deere, SharkNinja and Cummins, and The Verge relays that account.1
Reuters reported that the hacker, described as the "most active" among the exposed Cairn instances Norforge discovered, attacked companies based in the US, Canada, Australia, and Japan, laid out "preferred intrusion tactics" using fewer than 100 Chinese characters, and had successful breaches that took about 23 hours.1
Cummins spokesperson Melinda Koski told The Verge the company "is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors."1
A John Deere spokesperson told Reuters there is "no indication that sensitive information was accessed," while SharkNinja said the breach hit a standalone site with product support information and that it has contained the threat.1
The named hits were a vendor-run site and a standalone support page, not core systems, so the exposure for banks is likely in third-party and peripheral sites that carry their brand. Vendor inventories and monitoring of those sites matter more if attacks of this kind cost little to repeat across many targets.
Norforge says it is working to get the malicious Cairn instances taken down, and Cummins spokesperson Melinda Koski told The Verge the company "is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors."1
Our take. The attacker's instructions ran shorter than a text message, under 100 Chinese characters, and still reached more than 100 sites. The weak spot is vendor-run sites nobody watches.
Action. Third-party risk: Inventory vendor-hosted sites carrying your brand and confirm each sends logs to your SOC, with alerts for slow, persistent probing.