An open-source engine broke scores of sites on a few thousand dollars

NorForge's Snorre Fagerland scanned the internet for exposed control panels of Cairn, an open-source agent engine, and found about two dozen running attacks. A single Chinese-speaking operator drove most of them. The instructions were terse, sketched in fewer than 100 Chinese characters. Each successful break-in consumed roughly twenty-three hours of agent time.

Fagerland puts the bill at roughly $5,000 in model tokens, a guesstimate that could be off by a wide margin. That is about fifty dollars per successful break-in. The success rate was about one in ten. The operator aimed at more than twelve hundred sites, and Reuters established three of the victims: John Deere, SharkNinja and Cummins. Each downplayed the damage: Deere reported no indication that sensitive information was accessed, SharkNinja said the hack hit a standalone support site and was contained, and Cummins is investigating. How much data actually left, Reuters could not determine.

A finished task left a web shell behind. NorForge found that uploaded shell still live and reachable on a hardware-parts vendor's server, long after the agent run that planted it had ended. A Trufflehog secret-scan across the operator's projects surfaced hundreds of credentials, about one in ten of them still valid.

This campaign differs from the card-skimmer case this log covered on 24 September. That one was only ever profiled as a financially motivated actor. This one is a Chinese-speaking cluster on different infrastructure, chasing persistent access to payment and retail sites. Both ran on Cairn. And both used DeepSeek's V4.1 Flash model under a Claude Code harness.

Cairn's creator, who posts as le1xia0, said in public posts that the platform was never a hacking tool. They did not answer Reuters' questions. Misuse, they wrote, is a human decision, not a feature of the engine. Fagerland's line to Reuters is blunter: "It's a new world now."

Log take: The price of the attempt is the story here, a few thousand dollars to probe more than a thousand sites and break scores of them. (Interpretation; single-source campaign, attributed to NorForge and Reuters.)