Norforge discloses: attacker used fewer than one hundred characters of instructions to drive an army of AI agents to breach more than 100 enterprise websites

AI security company Norforge released a technical report, "Inside Cairn," on October 19, 2026, disclosing that an attacker used an army of AI agents orchestrated by the open-source problem-solving engine Cairn to breach more than 100 enterprise websites, with victims including John Deere, SharkNinja and Cummins. The attacker used fewer than one hundred characters to set intrusion tactical preferences, and reconnaissance, vulnerability discovery and breach were all completed autonomously by the agents, with an average time of about 23 hours per successful intrusion. Because the attacker left the Cairn web console open on the public internet without a password, Norforge was able to observe the intrusion process from outside, and through Shodan and Censys identified more than 20 open panels suspected of engaging in malicious activity; the most active cluster, AIA0001, contained 14 panels and more than 1,100 attack projects, with targets across the United States, Japan, Australia and Canada, and a motive of financial gain.