--- title: Open-source pentest agent Cairn used in AI-run breaches... description: An open-source pentesting agent called Cairn, meant for authorized testing, powered breach campaigns across South Korea and Japan within weeks. A researcher at... canonical: https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Open-source pentest agent Cairn used in AI-run breaches of 100+ companies | daily.dev og:description: An open-source pentesting agent called Cairn, meant for authorized testing, powered breach campaigns across South Korea and Japan within weeks. A researcher at... og:url: https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0 og:image: https://api.daily.dev/og/posts/ohS3PRHb0.png og:image:alt: Open-source pentest agent Cairn used in AI-run breaches of 100+ companies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Open-source pentest agent Cairn used in AI-run breaches of 100+ companies **[Collections](https://daily.dev/sources/collections)** · 6 min read · 2 upvotes · 0 comments ## Summary An open-source pentesting agent called Cairn, meant for authorized testing, powered breach campaigns across South Korea and Japan within weeks. A researcher at NorForge found a Chinese-speaking attacker running Cairn agents, mixing DeepSeek and Anthropic's Claude Code, that breached over 100 companies including Deere, SharkNinja and Cummins. Human instructions were under 100 Chinese characters, the agents compromised sites after roughly 23 hours of automated probing, and each successful hack cost about $50 in tokens, totaling about $5,000 for the whole campaign. In Japan, Ierae found about 20 targeted companies, almost all in Japan, with nine in the same industry. In South Korea, CrowdStrike tied the tool to a likely Chinese-speaking, financially motivated actor that ran it mainly on DeepSeek v4.1-flash against financial firms starting in late September. ## Content A Chinese-speaking attacker used AI agents to break into websites at more than 100 companies, according to a report from security firm NorForge that Reuters covered ahead of publication. The tool was Cairn, an open-source multi-agent platform that was not built for hacking. The attacker left its control panels exposed on the open internet, and that is how the campaign was found. ## How it was found Snorre Fagerland, a principal threat researcher at NorForge with almost three decades in security, came across the campaign by accident while scanning for inadvertently exposed Cairn instances. Starting around Oct 2 he found about two dozen being used for malicious activity, and for roughly four weeks he watched what the operators did. Cairn works like this: you give it a target and a goal, and it sets agents to work. Each agent posts findings to a shared project blackboard that every other agent reads, and a human operator can drop in hints. NorForge judged that more than 20 of the panels were likely malicious and grouped them into three clusters. Its assessment: "all appeared to have financial motivation; there was no obvious state-sponsored intrusion activity." "Chinese-speaking" is a language indicator, not an attribution. ## What the panels showed - **The largest cluster** has 14 panels (high confidence) and more than 1,100 attack projects. Targets were mostly e-commerce sites in the US, Japan and Australia, with Reuters adding Canada, and traffic of 200,000 to 1.5 million. An automated pipeline pre-validated each target before the agents saw it. The tasking was to find a way to run code on the site and plant an uploader web shell. NorForge reads the aim as "persistent access to e-commerce/payment infrastructure for later monetization." - **A second cluster**, in English, has 10 panels (high confidence) and is aimed at financial theft. Its tasking says things like "fetch credit cards" or "fetch crypto," with no technical starting instructions. Its operators also exposed SSH logins to their own staging hosts. - **A third cluster** is a single panel with 59 projects, assessed as malicious with low confidence. Other reporting says agents were pointed at SQL injection, unsafe file uploads, insecure deserialization and auth bypasses. Bloomberg separately reported that the same tool became the shared engine of breach campaigns in South Korea and Japan within weeks. The Japanese attack server examined targeted about 20 companies, almost all in Japan, and 9 of them were in the same industry. In South Korea, CrowdStrike tied the tool to a likely Chinese-speaking, financially motivated actor running it mainly on DeepSeek v4.1-flash against financial firms from late September. ## The stack All of the first cluster's tasks ran on a worker named claudecode_deepseek-v4.1-flash. NorForge says that "could mean a Claude Code harness using the Chinese DeepSeek 4.1 Flash model." The second cluster used workers named pi_openrouter_deepseek, which suggests the Pi coding-agent framework with DeepSeek models through OpenRouter. Other reporting mentions Cursor in similar attacks. NorForge also recovered one short-lived worker directory: a Kali container with browser automation, PHP gadget-chain generation, scanning tools and wordlists. A .claude/skills/ directory showed the environment had been repurposed from a CTF competition framework called "tsec." NorForge is explicit that "This is almost certainly criminals reusing existing tools, and there is no reason to believe that Tencent had anything to do with this operation." ## Cost The two cost figures rest on different bases, so they don't average. - Fagerland told Reuters the campaign cost roughly $5,000 in tokens, about $50 per successful hack. - NorForge's report estimates about $5 per task, counting failed or abandoned attempts, and says "the uncertainty here is however considerable." Projects with 1,000+ recorded intents "could end up costing more than $100." The campaign began Sept 25, and by late last week its agents had attempted more than 1,200 sites. Successful intrusions typically took around 23 hours of probing. NorForge estimates an average success rate of about 10% across the tools it observed, though the clusters had different goals and aren't directly comparable. Some tasks reportedly ran on instructions of under 100 Chinese characters. ## Verified, and self-inflicted NorForge independently checked one claimed intrusion, against "a large hardware parts vendor," and found the shell URL still serving a live uploader web shell. "Attackers can at any time change that into something more malicious." The exposed panels also leaked target lists, discovered weaknesses, and hundreds of credentials and API keys belonging to victims. TruffleHog verified 11% of the exposed secrets as valid. NorForge is working with Reuters to warn victims and is asking hosts to take the panels down. It also notes that "a considerable number of apparently legitimate red team operations were also exposed this way, potentially placing clients at risk." ## Victims These statements were given to Reuters. NorForge named none of the victims. - **Deere** says it took "necessary remediation actions" and has "no indication that sensitive information was accessed." - **SharkNinja** says the hack hit a standalone site carrying only product support information, and the threat was contained. - **Cummins** is "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." - Two smaller businesses also acknowledged being compromised. Reuters says it could not determine how far the breaches led to unauthorized data extraction. The SharkNinja case is worth dwelling on. Not every hit was a flagship site. A standalone support page still carries the brand, and someone has to patch it. Can a company name every site that carries its name, and who maintains each one? ## Cairn's author Cairn's author, posting as "le1xia0," acknowledged Reuters' message and did not answer questions. On X, the author wrote that the platform was "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention." ## Why it matters Fagerland had assumed hacker agents would need at least some supervision. He now says the technology has moved past that: "It's a new world now." He pointed to one technique the agents found. After finding no flaw in the public-facing app, they searched records for associated infrastructure, located a control panel, and after hours of trial and error got the server to execute commands. "It's not straightforward to come up with solutions like that. It's not script kiddie stuff." The operator writes an objective, like "fetch credit cards," rather than a plan, and the agents do the engineering. When a successful intrusion costs about fifty dollars and a day of unattended machine time, the main control left on volume is the target's own hardening. The irony is that the attackers failed at basic security themselves. They left their own dashboards open, which handed researchers the evidence and exposed their victims a second time. ## Questions this post answers ### What is Cairn and how was it used to breach over 100 companies? Cairn is an open-source agent built for authorized penetration testing that a Chinese-speaking cybercriminal repurposed to breach more than 100 companies, including Deere, SharkNinja and Cummins. The attacker ran it through an exposed Cairn instance using a mix of DeepSeek and Anthropic's Claude Code, with human instructions under 100 Chinese characters, and each breach took about 23 hours and cost roughly $50 in tokens. _Developers tracking how AI agents get weaponized for attacks can follow coverage like this on daily.dev._ ### How much did the Cairn-based hacking campaign cost the attackers? Each successful hack cost about $50 in tokens, and the entire campaign across more than 100 companies cost roughly $5,000 total. The attackers were discovered because they left their own agent dashboard without a password, exposing the activity to researchers. _Security teams budgeting defenses against cheap, automated attacks can keep up with cases like this via daily.dev._ ### Which AI models were used in the Cairn breach campaigns in Japan and South Korea? The South Korean campaign, tied by CrowdStrike to a likely Chinese-speaking, financially motivated actor, ran mainly on DeepSeek v4.1-flash against financial firms starting in late September. The broader Cairn-based campaign documented by NorForge mixed DeepSeek with Anthropic's Claude Code, while a Japanese attack server examined by Ierae targeted about 20 companies, mostly in one industry. _Anyone evaluating which AI models pose attack risk can track incidents like these on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 1 comments across x (as of 2026-10-22). **TL;DR:** There's very little discussion to go on, but the one substantive reply points to neglected, forgotten web assets as the real root cause of breaches like this rather than flagship systems. **Sentiment:** 0% positive · 20% mixed · 80% skeptical **The pushback** - Forgotten support pages and old microsites are often the actual entry point, since they rarely get patching budget. **By community** - x (skeptical): A reply suggests the real risk lies in neglected legacy pages rather than well-maintained main sites. **Highlights** > @Lewis502 Forgotten support pages and old microsites are where most breaches start, not the flagship. Nobody budgets for patching a page they forgot they own. > — [MaximLevoshin on x](https://x.com/MaximLevoshin/status/2113318169935012337) **Source threads** - [x](https://x.com/Lewis502/status/2113312445343121637) · 2 points · 1 comments ## Similar posts on daily.dev - [I Asked 100 Agents to Hack Me](https://daily.dev/posts/i-asked-100-agents-to-hack-me-wrbcfxglt) · Tech Lead Digest · 1 upvotes · 0 comments - [AI helps Chinese-speaking hackers speed up attacks on exposed servers](https://daily.dev/posts/ai-helps-chinese-speaking-hackers-speed-up-attacks-on-exposed-servers-os1x7amnl) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code), [#deepseek](https://daily.dev/tags/deepseek) [View this post on daily.dev](https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Open-source pentest agent Cairn used in AI-run breaches of 100+ companies","url":"https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0"},"datePublished":"2026-10-20T12:48:36.951Z","dateModified":"2026-10-22T18:05:53.732Z","description":"An open-source pentesting agent called Cairn, meant for authorized testing, powered breach campaigns across South Korea and Japan within weeks. A researcher at...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,claude-code,deepseek","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Open-source pentest agent Cairn used in AI-run breaches of 100+ companies"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/open-source-pentest-agent-cairn-used-in-ai-run-breaches-of-100-companies-ohs3prhb0#faq","mainEntity":[{"@type":"Question","name":"What is Cairn and how was it used to breach over 100 companies?","acceptedAnswer":{"@type":"Answer","text":"Cairn is an open-source agent built for authorized penetration testing that a Chinese-speaking cybercriminal repurposed to breach more than 100 companies, including Deere, SharkNinja and Cummins. The attacker ran it through an exposed Cairn instance using a mix of DeepSeek and Anthropic's Claude Code, with human instructions under 100 Chinese characters, and each breach took about 23 hours and cost roughly $50 in tokens. Developers tracking how AI agents get weaponized for attacks can follow coverage like this on daily.dev."}},{"@type":"Question","name":"How much did the Cairn-based hacking campaign cost the attackers?","acceptedAnswer":{"@type":"Answer","text":"Each successful hack cost about $50 in tokens, and the entire campaign across more than 100 companies cost roughly $5,000 total. The attackers were discovered because they left their own agent dashboard without a password, exposing the activity to researchers. Security teams budgeting defenses against cheap, automated attacks can keep up with cases like this via daily.dev."}},{"@type":"Question","name":"Which AI models were used in the Cairn breach campaigns in Japan and South Korea?","acceptedAnswer":{"@type":"Answer","text":"The South Korean campaign, tied by CrowdStrike to a likely Chinese-speaking, financially motivated actor, ran mainly on DeepSeek v4.1-flash against financial firms starting in late September. The broader Cairn-based campaign documented by NorForge mixed DeepSeek with Anthropic's Claude Code, while a Japanese attack server examined by Ierae targeted about 20 companies, mostly in one industry. Anyone evaluating which AI models pose attack risk can track incidents like these on daily.dev."}}]} ```