One person gives an instruction, and several programs divide up the job of finding weak spots across the internet. They do not need breaks or fresh directions at every turn. That is the model behind a campaign that reportedly gained access to more than 100 websites, according to research by cybersecurity firm NorForge, reported by La Razón citing The Verge.
John Deere, SharkNinja, and Cummins are among the companies named. But an important distinction matters here: gaining access to a website does not necessarily mean breaching a company’s entire network, and it does not establish that customer data was stolen.
What the AI agents reportedly did
According to researcher Snorre Fagerland, the campaign targeted more than 1,200 websites in the United States, Canada, Australia, and Japan beginning September 25, 2026.
The person behind it reportedly used Cairn, an open-source tool that coordinates AI agents. These are programs that can carry out tasks toward a goal, share findings, and adjust their approach when something fails.
In this case, the investigation says, the agents searched for security weaknesses and attempted to exploit them to access servers and maintain that access. Their initial instructions were fewer than 100 characters long. That does not make the attack effortless: it still relied on software, AI services, and many hours of automated attempts.
Fagerland estimates roughly 23 hours of automated work for each successful intrusion and approximately $5,000 in total AI service costs, or about $50 per successful breach. Those are the researcher’s estimates, not a standard price or an independently verified accounting.
What the companies have acknowledged
The available company statements describe different situations. They do not establish a widespread theft of information:
- John Deere says it has no indication that confidential information was accessed and has taken corrective action.
- SharkNinja acknowledges an incident limited to a standalone product support website and says the threat has been contained.
- Cummins is investigating a possible attack involving a website managed by an outside provider.
It remains unclear what information may have been exposed across the campaign or whether data was taken from every compromised site. The person responsible has not been identified.
Why this matters beyond corporate IT departments
The concern is not that an unbeatable AI has arrived. It is that one person can delegate much of the work and keep numerous attempts running with limited supervision. That could put more pressure on services people use to shop, check warranties, or request support.
For businesses, the case underscores the importance of updating systems, securing administrative access, and reviewing websites operated by outside vendors. A secondary support page still needs protection, even if it is not the main online store.
For consumers, the usual precautions remain useful: use a different password for each service, enable two-step verification where available, and pay attention to official security notices. The published information does not establish that every customer of the named companies has been affected.
The central issue is who controls the tool and whether they have permission to use it on a particular system. Automating an authorized security review can help protect a website. Directing the same capabilities at someone else’s systems without permission turns them into a threat.
