On October 19, 2026, Reuters reported something that should worry every small-business website owner: a single Chinese-speaking hacker used autonomous AI agents to target more than 1,200 websites — and broke into over 100 of them. Victims included Deere (John Deere), SharkNinja, and Cummins. The agents worked on their own for around 23 hours per successful break-in, at a cost of about $50 in AI tokens each.
If you run a business website, AI agents hacking websites is no longer a far-off threat — it is happening now. Here is how the attack worked and what you can do to protect your site.
What Is the Cairn AI Hacking Campaign?
Cairn is an open-source AI problem-solving platform that coordinates multiple AI agents to work through tasks together. It was never designed as a hacking tool — its creator (who posts under the name le1xia0) says it is a general multi-agent system and that harmful use was never the intention.
But criminals found a use for it anyway. NorForge found more than 20 publicly exposed Cairn installations being used for malicious activity beginning around October 2, and principal threat researcher Snorre Fagerland tracked it.
The largest campaign came from one Chinese-speaking hacker who began targeting e-commerce websites around September 25. Given a target and an objective, the AI agents investigated, hunted for weaknesses, tested exploits, and worked to gain persistent access — on their own.
In one case, after failing to crack a company’s public application, the agents found related infrastructure through digital records, located an exposed control panel, and used a flaw to run unauthorized commands — the kind of creative, multi-step attack that used to need a skilled human.
AI Agents Hacking Websites: How This Campaign Was Different
AI has been used in cybercrime before, but there is an important distinction. In earlier AI-powered cyberattacks in 2026, humans drove the operation and AI assisted. Here the agents worked autonomously — the hacker set the objective and walked away. Fagerland said this changed his earlier view that hackers must supervise these systems closely.
The agents also played the long game: they were instructed to find a way to run code on the server, then plant a web shell — a hidden backdoor giving persistent access to the shop’s systems and payment infrastructure. A web shell means the attacker can return whenever they want.
The economics of autonomous AI hacking
The campaign cost roughly $5,000 in AI tokens in total — about $50 per successful breach, roughly $5 per attempt. The tools appeared to combine China’s DeepSeek models with Anthropic’s Claude Code (a worker labeled “claudecode_deepseek-v4.1-flash” was spotted on the platform), though the exact contribution of each tool was not fully established.
For the price of a cheap laptop, one person attempted to hack 1,200+ websites. Attackers can now deploy cheap AI agents to probe software around the clock, while defenders must investigate, prioritize, patch, and verify.
AI-Assisted vs AI-Agent Attacks: What Changed
| Factor | AI-assisted attacks (older) | AI-agent attacks (2026 Cairn campaign) |
|---|---|---|
| Human role | Human drives; AI helps with drafting, coding | Human sets objective; agents work alone |
| Duration of attack | Minutes to hours, human-supervised | ~23 hours per successful intrusion, unsupervised |
| Attack steps | Usually one task at a time | Chained sequences: recon, exploit, persist |
| Cost per attack | Higher (human time is expensive) | ~$5 per attempt, ~$50 per success |
| Scale possible | Limited by hacker headcount | 1,200+ targets by one person |
| Goal | Quick access or data grab | Lasting access via web shells |
This is not isolated: in August 2026, Gambit Security reported Russian-speaking criminals using the AI coding tool Cursor against seven organizations, and in September documented another campaign hitting 25 companies. The Cairn campaign is simply the clearest proof so far that autonomous AI hacking works at scale.
The Victims: What Happened to Deere, SharkNinja, and Cummins
NorForge did not name victims, but Reuters independently identified them from the hacker’s Cairn activity. The campaign focused on e-commerce sites in the US, Canada, Australia, and Japan.
- Deere (John Deere): Took “necessary remediation actions”; said it had “no indication that sensitive information was accessed.”
- SharkNinja: The hack involved a standalone site with only product support information; the threat was contained.
- Cummins: Said it was investigating a potential cyber-attack on a website operated by one of its third-party vendors.
- Smaller businesses: Two smaller businesses also confirmed they were compromised — this was not just a big-company problem.
One unknown: the researcher could not establish how much data was taken. For a small-business owner, that uncertainty is exactly why prevention matters more than damage control.
How to Protect Your Website From AI-Powered Attacks (2026 Defense Guide)
AI agents scan thousands of sites automatically and exploit whichever ones are vulnerable — fame is irrelevant. Here is a practical defense checklist:
1. Patch everything, on schedule
AI agents hunt for known vulnerabilities in outdated software — WordPress core, plugins, themes, and server packages. Enable automatic updates and check weekly — most breaches exploit flaws that already had patches. See our cybersecurity threats and solutions guide.
2. Put a Web Application Firewall (WAF) in front of your site
A WAF filters malicious traffic before it reaches your server. Cloudflare and Sucuri offer affordable plans for small sites (from about $20/month), and many hosts include a basic WAF free.
3. Lock down admin panels — never expose them publicly
This campaign was discovered because exposed panels were found online. Restrict access to /wp-admin/ and control panels, use strong unique passwords, and enable multi-factor authentication (MFA) on every admin account.
4. Apply the principle of least privilege
Every user, plugin, and integration should have only the minimum access it needs. Remove old admin accounts, deactivate unused plugins, and revoke stale API keys.
5. Monitor for web shells and suspicious files
Because AI agents aim for persistent access, set up file-integrity monitoring (Wordfence has a free tier). Watch for unexpected PHP files, especially in upload directories.
6. Back up your site — and test the backups
Keep automated daily backups stored off-site (your host likely offers this; UpdraftPlus is a solid WordPress option), with at least one copy isolated from your server. See our ransomware prevention and recovery guide for a full plan.
7. Watch out for social engineering
Technical defenses fail when attackers trick people. Train anyone with site access to recognize phishing — see our social engineering attacks guide.
8. Get a professional security review
A one-time security audit is money well spent — see our services or contact us.
FAQ: AI Agents and Website Hacking
What is the Cairn AI hacking campaign?
A 2026 campaign in which a Chinese-speaking hacker used Cairn — an open-source multi-agent AI platform — to autonomously attack 1,200+ websites, breaching 100+ company sites including Deere, SharkNinja, and Cummins. Uncovered by NorForge’s Snorre Fagerland; reported by Reuters on October 19, 2026.
Can AI agents really hack websites by themselves?
Yes. Earlier attacks had humans driving with AI assisting; here the hacker gave the agents a target and an objective, and they handled reconnaissance, vulnerability discovery, and exploit testing alone for about 23 hours per successful intrusion.
How do I protect my website from AI-powered attacks?
The fundamentals still work: keep all software patched, use a Web Application Firewall, enable MFA on admin accounts, never expose admin panels publicly, follow least-privilege access, monitor for web shells with file-integrity scanning, and keep tested off-site backups.
Was my data stolen in this campaign?
The researcher could not determine how much data was taken. Deere said it had no indication sensitive information was accessed, and SharkNinja said the affected site held only product support information. But since the agents planted web shells for persistent access, affected companies should assume the worst and audit thoroughly.
Does this mean small websites are targets too?
Absolutely. AI agents exploit whatever is vulnerable — they do not check company size. Two smaller businesses were already compromised in this campaign, and a small site with outdated plugins is an easier target than a well-defended large one.
Conclusion: AI Agents Hacking Websites Is the New Normal
The Cairn campaign proves a hard truth: AI agents hacking websites is no longer experimental — it is operational, cheap, and scalable. One person, about $5,000 in AI tokens, and more than 100 breached company websites.
The good news: none of the defenses are exotic. Patched software, a WAF, MFA, locked-down admin panels, monitoring, and backups would have stopped or contained most of these intrusions. The bad news: AI agents never get tired and try thousands of doors until one opens.
Do not wait for an incident to take your website security seriously. Review the checklist above this week — or take a look at our services and get in touch for expert help. In the age of autonomous AI hacking, a secure website is not a luxury — it is the cost of doing business online.
Sources: Reuters reporting (Oct 19, 2026) on NorForge’s research; PYMNTS coverage of the NorForge findings.
