NorForge has published an investigative report stating that cyberattackers used AI agents to attempt to penetrate the websites of more than 100 companies in the United States, Canada, Australia and Japan. The attacks reportedly began with instructions of fewer than 100 Chinese characters, after which the AI agents autonomously searched for vulnerabilities and attempted to gain access.
Cybersecurity company NorForge reportedly published an investigative report on 19 October 2026 stating that hackers had used AI agents to attempt to penetrate the websites of more than 100 companies in 4 countries. The affected companies reportedly included major companies such as John Deere, SharkNinja and Cummins.
According to the report, the only instructions given to the AI were Chinese prompts of fewer than 100 characters, after which the AI agents autonomously searched for vulnerabilities in the targets and attempted to gain access. Total token costs associated with AI use were estimated at approximately $5,000, while the cost per successful intrusion was approximately $50. The open-source AI platform Cairn played a central role, and the attackers reportedly used AI agents integrated with DeepSeek and Claude Code.
More than 20 publicly exposed Cairn instances were also observed, including cases in which they were used to direct attacks. The hackers began the attacks on 25 September 2026 and attempted to penetrate more than 1,200 e-commerce sites. The reported success rate was approximately 10%, with successful intrusions into more than 100 companies in total. Completion of an intrusion reportedly took approximately 23 hours.