Cybercriminal Reportedly Used Cairn AI Agents to Breach More Than 100 Company Websites

An operator using Chinese-language instructions reportedly directed Cairn, an AI agent framework, to breach more than 100 company websites. The campaign targeted sites in the U.S., Canada, Australia, and Japan. Researchers verified unauthorized access tools on victim servers. Reuters identified websites belonging to farm equipment maker Deere and appliance maker SharkNinja; the extent of data theft remained unclear.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The incident involves the use of autonomous AI agents to conduct large-scale cyberattacks and intrusions against over 100 companies.

Additional risk subdomains

• 4.3 Fraud, scams, and targeted manipulation: The AI agents were also tasked with stealing credit card data and attempting to rob cryptocurrency exchanges for financial gain.
• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The attacks resulted in the theft of credit card data and the public exposure of hundreds of corporate credentials and secrets.

Causal factors

• Entity: AI
• Intent: Intentional
• Timing: Post-deployment

The cyberattacks were executed autonomously by AI agents deployed post-training, directed by a human actor with malicious intent.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI system was used to autonomously compromise commercial infrastructure, posing significant implications for cybersecurity, public interest, and safety.

AI system and alleged parties

• AI system: Cairn, Claude Code, DeepSeek (Anthropic, DeepSeek)
• AI purpose: Code Generation; Technical Text Generation
• Behaviour type: Multi-agent
• Alleged developer: le1xia0, Large language model developers, DeepSeek, AI agent system developers
• Alleged deployer: hackers, Cybercriminals, AIA0001, AI agent system deployers
• Alleged harmed parties: SharkNinja, Privacy, Information security, Deere, Cummins, Companies

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Minor, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Infrastructure

Reported: The report explicitly describes infrastructure damage in the form of compromised corporate servers and websites.

Directly caused: AI agents successfully breached websites of over 100 companies, injecting webshells to gain persistent unauthorized access to their servers.

Inferred additional harm: Further corporate servers and website infrastructure of the 1,200 targeted sites may have been compromised or disrupted.

Financial

Reported: The report describes hackers using AI to steal credit card data and attempt to rob a cryptocurrency exchange, as well as spending $5,000 on API tokens.

Directly caused: The hackers spent approximately $5,000 on AI tokens to run the campaign, averaging $50 per successful hack.

Indirectly caused: Companies like Deere, SharkNinja, and Cummins incurred remediation and investigation costs following the breaches.

Inferred additional harm: Significant financial losses are likely from the stolen credit card data and cryptocurrency, as well as millions of dollars in corporate remediation and incident response costs across the 100+ compromised companies.

Privacy

Reported: Yes, the report explicitly describes the theft of credit card data and the exposure of hundreds of credentials and secrets on public Cairn panels.

Directly caused: One hacker stole a trove of credit card data, and the exposed Cairn panels leaked hundreds of API keys, credentials, and target secrets, with 11% verified as valid.

Inferred additional harm: Thousands of customers of the compromised e-commerce websites likely had their personal and financial information exposed or stolen.

People affected

• Occurrences reported: 1

Potential causes

Management

• Weak Vendor Patch Management: Target companies fail to patch known flaws like CVE-2026-75650.
• Third-Party Risk Management: Victims suffer breaches through unsecured third-party vendor sites.
• Insecure Operational Setup: Hacking groups fail to govern and secure their own infrastructure.

Technology

• Autonomous Agentic Capabilities: Agents autonomously exploit vulnerabilities without human supervision.
• Low-Cost Powerful LLMs: Cheap models like DeepSeek lower the financial barrier to scale attacks.
• Dual-Use Problem Solving Tools: Problem-solving tools like Cairn are easily repurposed for hacking.

Data Inputs

• Terse Operator Instructions: Brief prompts under 100 characters are enough to trigger complex hacks.
• Automated Target Feeding: Pipelines feed pre-verified target lists directly into AI agents.
• Exposed Credentials: Unsecured API keys on open panels are ingested by agent operations.

Human Factors

• Negligent Panel Security: Operators leave Cairn control panels completely open to the public.
• Malicious Intent of Operators: Hackers deliberately task AI agents to steal data and upload shells.
• Red Team Operational Errors: Legitimate testers expose customer secrets on unsecured panels.

Process and Methods

• Repurposed CTF Frameworks: Attackers reuse benign training/CTF agent skills for real intrusions.
• Continuous Probing Cycles: Agents run multi-hour trial-and-error loops until they find weaknesses.
• Buggy Domain Normalization: Flawed scripts strip characters from domains, showing automated feeding.

Regulatory Environment

• Lack of Model Safeguards: Commercial APIs lack robust safety filters to block offensive tasks.
• Open-Source Code Misuse: No regulations prevent hosting dual-use offensive agentic code.
• Inadequate API Access Controls: Global API gateways allow anonymous access to powerful models.

Information quality

• Classification confidence: High
• Reason for confidence: The reports are highly detailed, coming from a reputable news source and a cybersecurity firm, providing specific technical details, indicators of compromise, and case studies.
• Ambiguities identified: The exact extent of data extraction or financial theft from the breaches remains unconfirmed for many victims.
• Alternative interpretations: Some might view this as a traditional cyberattack where AI is merely a tool, rather than an AI safety incident, but the autonomous decision-making of the agents points to a clear AI safety risk.

This incident represents a significant milestone in cyber threat capabilities, showcasing the first successful, large-scale deployment of autonomous multi-agent AI systems to conduct cyber intrusions. Executed at an extremely low cost of $50 per successful breach, the campaign compromised over 100 Western corporate entities, demonstrating a highly scalable economic and technological threat to corporate networks.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: United States, Canada, Australia, Japan
• Alleged perpetrator: Chinese-speaking hacker

Threat characteristics

• Imminence: Long-term. Represents an active, evolving capability of autonomous cyber tools that poses a strategic, long-term threat to corporate and economic security.
• Autonomy: Full autonomy. AI agents executed multi-step cyber reconnaissance, vulnerability identification, and exploit deployment autonomously without human intervention.
• Novelty: First-of-its-kind. First documented case of an autonomous multi-agent AI framework successfully conducting a coordinated, large-scale cyber intrusion campaign against global corporate targets.

Impact by dimension

• Physical security: Minor. Web-facing breaches of corporate entities including Deere and Cummins occurred, but did not result in kinetic disruption or critical infrastructure control system compromise.
• Information security: Minor. Involved the theft and exposure of corporate credentials and API keys, but did not target classified government networks or compromise state intelligence capabilities.
• Sovereignty: Negligible. No direct compromise of government decision-making, electoral systems, or core state operations was reported.
• Economic security: Substantial. Substantial economic threat demonstrated by the highly efficient, low-cost ($50 per breach) autonomous compromise of over 100 major Western corporations, exposing proprietary credentials and customer data.
• Societal stability: Minor. Privacy implications exist due to the theft of credit card data and credentials, but did not scale to broad societal instability or human rights abuses.