An investigation by NorForge and a separate review by Reuters have put a sharper boundary around a new kind of cyber-risk story: AI agents may be helping with intrusions, but a list of exposed dashboards is not a list of confirmed victims. The reporting describes more than 20 publicly reachable Cairn panels that appeared connected to malicious activity, hundreds or thousands of projects, and one task URL that NorForge says served a live uploader and command-execution webshell. It also leaves important questions open, including how many attempts became durable access and whether data was taken.

What was exposed

NorForge’s Oct. 19 investigation focused on exposed panels associated with Cairn, a general-purpose AI-agent system whose developer says it was not designed for hacking. The panels appeared to expose project or task information that could be inspected from the internet. NorForge identified more than 20 panels it considered likely to be associated with malicious activity, rather than claiming that every Cairn deployment was compromised or that every operator had the same objective.

The largest cluster, labeled AIA0001 in NorForge’s reporting, comprised 14 panels and more than 1,100 projects. Other clusters included 10 panels, while one panel showed 59 projects. Those numbers are observations of exposed infrastructure and dashboard activity. They are not a verified count of organizations breached, nor a direct count of successful intrusions. A project can represent an attempted objective, a research item, or a record whose eventual outcome is not visible to an outside observer.

That distinction is central because AI-assisted operations can generate a large amount of machine-readable activity quickly. A panel can show what an operator asked an agent to do without proving that the target was reachable, that a vulnerability was exploited, that credentials were obtained, or that access persisted. The exposed panels are therefore an important lead and a security failure in their own right, but they are not a final incident ledger.

The evidence ladder

The strongest way to read the reporting is as a ladder of increasingly specific evidence. At the first rung are exposed panels and projects: NorForge observed the interfaces and associated records. At the next are attempted targets. Reuters reported more than 1,200 attempted sites and more than 100 identified company websites in its independent review. “Attempted” is doing real work in that sentence; it does not mean each site yielded a foothold.

NorForge estimated an average task-success rate of about 10 percent. It also estimated that successful goals in the AIA0001 cluster took less than 23 hours on average and produced about 140 facts. Those figures are observational estimates, and the units are not identical to Reuters’ reporting. Reuters described a typical successful intrusion as taking roughly 23 hours and estimated total model-token spending at about $5,000, or approximately $50 per successful hack. These estimates help explain the economics and pace of the activity, but they are not independently audited measurements.

Higher on the ladder is a specific technical artifact. NorForge says it validated one task URL at a hardware-parts vendor that served a live uploader and allowed command execution—a webshell. That is materially stronger than a dashboard entry because it is a direct observation of an active capability at one location. NorForge also described other cases in redacted form. The validation does not establish that every listed target had a webshell, or that a webshell was used to steal data.

The highest rung would be a documented compromise with a known scope, confirmed access, and evidence of what was taken. The public reporting does not provide that complete picture. Readers should not collapse exposed panels, attempted sites, estimated successes, a validated webshell, confirmed company impact, and data theft into one number.

What Reuters added

Reuters’ independent reporting broadened the picture beyond NorForge’s panel-focused investigation. It reviewed activity involving more than 1,200 attempted sites and identified over 100 company websites, while describing the operation’s approximate cost and the roughly day-long timescale for a typical successful intrusion. The overlap is significant: it supports the view that the exposed Cairn infrastructure was connected to a real campaign of attempted activity, not merely a benign test environment.

But “independent” does not mean Reuters resolved every uncertainty. Reuters could not determine the extent of any exfiltration. NorForge’s public evidence likewise does not establish that the projects shown on the panels correspond one-for-one with successful breaches. The two accounts use different lenses: NorForge reports what it found in exposed Cairn panels and its technical validation; Reuters reports its review of targets, companies, and the apparent economics. Their figures should be read alongside one another, not added together.

The combination is still consequential. It suggests that general-purpose agents can be placed inside an intrusion workflow in which reconnaissance, task management, and repetitive execution are delegated or accelerated. It does not prove that Cairn itself was built as a hacking product, that its developer participated, or that a particular language or model label identifies the operators or a sponsoring state. Those are separate questions for which the packet supplies no support.

Company responses are not all the same

The named companies’ responses show why a careful article should avoid “all victims were breached” language. Deere said it remediated the issue and had no indication that sensitive data was accessed. That is a response to a reported exposure or incident, not a confirmation of a successful data theft. SharkNinja said the affected site was a standalone support site and that the issue was contained, a narrower description of scope than a compromise of its broader corporate environment.

Cummins said it was investigating a potential attack on a site operated by a third-party vendor. “Potential” and “third-party vendor” both matter: the statement neither confirms a completed breach of Cummins’ core systems nor rules one out. The Verge’s additional reporting and Reuters’ account also reported that two smaller businesses acknowledged compromise. The packet does not provide enough detail to generalize those acknowledgments to all the other identified websites.

These responses reflect different stages of incident handling: remediation, containment, investigation, and acknowledgment. None should be silently translated into a common label. NorForge redacted some names, and public statements naturally reveal only part of an organization’s internal forensic picture. The responsible conclusion is that some companies were contacted about suspicious activity, some described remediation or containment, and at least two smaller businesses acknowledged compromise; the full victim and impact set remains unresolved.

What remains unknown

The biggest unknown is the conversion rate from agent task to durable access. A project count is not a foothold count, and a claimed or estimated success is not the same as a company-confirmed compromise. The available evidence also does not tell us how long access lasted at each target, whether credentials were reused, whether defenders interrupted operations, or whether the operators returned after remediation.

Data extraction is another open question. The presence of a live uploader and command-execution webshell demonstrates capability at one vendor, but it does not show what files were uploaded or downloaded, whether secrets were copied, or whether the operator exfiltrated data from any other site. Reuters explicitly could not determine the extent of exfiltration. Until affected organizations publish forensic findings—or investigators obtain evidence that can be independently checked—claims about stolen records would go beyond the packet.

There are also attribution limits. The name Cairn, model or language labels, and the existence of an AI-enabled workflow do not establish who ran it, where they were located, or whether a vendor or government directed the activity. Cost estimates based on model tokens likewise describe an apparent operating expense, not the full cost of infrastructure, access, labor, or recovery. Those caveats are not technicalities; they define what the evidence can legitimately support.

Why the language matters

The story is strongest when it describes a documented chain: exposed Cairn panels; attempted targets visible in independent reporting; estimates of task success and operating cost; one NorForge-validated webshell; and company-specific responses. It is weaker when those steps are compressed into a headline claiming that scores of businesses were hacked or that an AI developer breached them.

That precision serves both security teams and the public. Defenders need to know that an exposed orchestration panel can reveal operational traces and that an agent may be able to carry out long, repetitive tasks. Companies need to distinguish an attempted attack from verified access so they can communicate scope without creating either false reassurance or unnecessary alarm. Readers need to see which sentence is an observation, which is a company statement, which is a reporter’s finding, and which is an estimate.

On the evidence currently available, NorForge and Reuters have documented a serious, AI-assisted intrusion picture with real technical validation and unevenly confirmed effects. They have not established that every project succeeded, that every named site was breached, or that data theft occurred at scale. That is a narrower conclusion than a mass-breach claim—but it is also the conclusion the evidence can bear.

FAQs

Did Cairn breach more than 1,200 websites?

Not on the public evidence. Reuters reported more than 1,200 attempted sites, not 1,200 confirmed breaches. NorForge’s project counts and estimated success rate cannot be converted directly into a verified victim count.

What was actually validated?

NorForge says it validated one task URL at a hardware-parts vendor that served a live uploader and enabled command execution through a webshell. That confirms one active capability, not a universal condition across the listed projects.

How many companies were confirmed compromised?

The packet does not provide a complete confirmed count. Reuters reported that two smaller businesses acknowledged compromise; Deere, SharkNinja, and Cummins gave different, more limited responses involving remediation, containment, or an investigation.

Is there evidence that data was stolen?

The extent of exfiltration is unknown. A webshell can provide a path to move or manipulate data, but the reporting does not establish what was taken from the vendor or from other targets.

Does the investigation show Cairn’s developer was involved?

No. The Cairn developer said the system is general-purpose and was not designed for hacking. The packet provides no evidence that the developer participated in, directed, or endorsed the activity.

References