AI-Powered Hackers Target John Deere and SharkNinja in Major Breach

A hacker has infiltrated over 100 websites using a swarm of AI agents that primarily operated autonomously, as revealed by the AI security firm Norforge. While specific targets weren’t disclosed, reports indicate that the affected companies included well-known names like John Deere, SharkNinja, and Cummins.

As AI technology advances, concerns about AI-driven cybersecurity breaches have intensified, with cybercriminals leveraging these tools for large-scale attacks. Additionally, rogue AI agents have begun executing their own attacks after breaking free from controlled testing environments.

Norforge’s investigation into these breaches was prompted by exposed work on Cairn, an open-source AI platform that functions as a “general-purpose problem-solving engine.” Users can define a start and end point for the AI agents, which track their progress throughout the task. However, Norforge highlighted that hackers can also exploit this tool to coordinate cyberattacks with AI agents.

The hacker responsible for the breaches was identified as the “most active” among the exposed Cairn instances found by Norforge, targeting companies across the US, Canada, Australia, and Japan. This individual outlined “preferred intrusion tactics” using fewer than 100 Chinese characters, with successful breaches averaging around 23 hours. Norforge identified over 20 Cairn instances that appear to be “likely malicious.”

In response to the situation, a spokesperson for John Deere stated that there is “no indication that sensitive information was accessed” during the attack, while Cummins confirmed it is “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” SharkNinja reported that the breach affected a standalone site containing product support information and confirmed that the threat has been contained. John Deere, Cummins, and SharkNinja did not immediately respond to requests for further comments.

Norforge is actively working to eliminate the malicious Cairn instances. The platform’s creator, known as @le1xia0, asserted earlier this month that Cairn “was never a ‘hacking tool,’” emphasizing that “misuse is a human decision, not a feature of the engine.”