Fewer than 100 Chinese characters. That was all one hacker needed to set up an army of AI agents that breached more than 100 websites, including John Deere, SharkNinja, and Cummins. The security firm Norforge found the attacks exposed on Cairn, an open-source AI platform, and the agents did nearly all of the work themselves. Average time to a successful breach: about 23 hours. Norforge identified more than 20 exposed Cairn instances it considers likely malicious.

If you run quality, operations, or IT in a manufacturing business, the economics just shifted against you. Attacks that once needed a skilled team now need a prompt. Below, we break down what these breaches actually reveal, where your third-party vendors leave you exposed, and how to put agents to work on defence.

One Hacker, 100 Sites, 23 Hours: The Economics of Attack Just Broke

Look at what that campaign actually cost to run. One person, an open-source platform that bills itself as a “general-purpose problem-solving engine,” and targets spread across the US, Canada, Australia, and Japan. No crew, no payroll, no coordination overhead. The agents set their own path between a start point and an end point and logged the work as they went.

Your security spend assumes attackers are expensive. Pen tests on an annual cycle, a small SOC, patch windows measured in weeks: all of it priced against humans who have to pick their targets carefully because their time is scarce. That constraint is gone.

And the way in rarely looks dramatic. Cummins said it was investigating “a potential cyber-attack on a website operated by one of our third-party vendors.”

How the Cairn Agents Actually Ran the Attacks

Cairn is not an attack tool. It is an open-source platform that describes itself as a “general-purpose problem-solving engine.” You give it a start point and an end point, and the agents work out the steps in between, documenting their own progress as they go.

That documentation habit is how Norforge found the campaign at all. The instances were exposed, so researchers could read the agents’ own logs of what they were doing and to whom.

Why goal-directed agent loops transfer cleanly from automation to intrusion

An agent loop does not care whether the goal is reconciling invoices or finding a way into a web server. The mechanics are identical: state an objective, try something, read the result, adjust, repeat until the end condition is met.

Reconnaissance, credential testing, and lateral movement are all search problems with clear success signals. That is precisely the shape of task these systems handle well. No one had to build an attack platform. They pointed an existing automation engine at a different endpoint.

What “little human involvement” means for attack volume and persistence

When the human is only setting objectives, one operator can run many campaigns at once. Norforge found more than 20 exposed Cairn instances it considers likely malicious, hitting targets across the US, Canada, Australia, and Japan simultaneously.

Persistence changes too. A human attacker gets bored, gets distracted, moves to easier prey. An agent keeps probing until it hits the end condition or runs out of compute. Your defences no longer face someone who gives up on a hardened target. They face a process that simply continues.

The Breaches Landed on Vendor Sites, Not Factory Floors

Read the corporate statements closely and a pattern shows up. Cummins spokesperson Melinda Koski said the company “is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” SharkNinja said the breach hit a standalone site carrying product support information, and that it has contained the threat. John Deere told Reuters there was “no indication that ​sensitive information was accessed.”

None of these were plant networks or ERP systems. They were peripheral web properties, outsourced, rarely patched, and almost never on anyone’s quarterly risk review. That is exactly why the agents got in. Goal-directed agents probe everything attached to your brand, and they find the thing with the oldest CMS first.

Inventorying the web properties nobody owns internally

Most manufacturers cannot produce an accurate list of their own internet-facing assets. Dealer portals built by a regional distributor. Product registration microsites launched for a trade show in 2019. Warranty claim forms hosted by a marketing agency that no longer has your business. Spare parts catalogues running on a vendor’s shared hosting. Each one carries your logo, and to an attacker each one is a front door.

Start with a hard inventory. Pull every domain and subdomain registered to the company, cross-check against marketing, after-sales, and each regional office, then map who actually controls the hosting and the code. For every property you find, assign a named internal owner and a contractual security obligation on the vendor side. Anything you cannot assign an owner to should be taken offline, not fixed. Dead microsites are pure liability, and shutting them down costs nothing.

What Manufacturing Leaders Should Change in the Next 90 Days

Three things need to move, and they need to move in order: know what you own, write the vendor rules down, then shorten your detection window. Everything else can wait a quarter.

The asset and vendor register you can build in two weeks

Most manufacturers cannot name every domain, subdomain, and microsite carrying their brand. Marketing spun up a campaign page in 2021. A distributor hosts your spare parts catalogue. A service partner runs the warranty portal. Pull DNS records, certificate transparency logs, and the last three years of marketing and procurement invoices, and you will have a usable list inside two weeks.

Then attach an owner and a vendor to each line. For anything a third party hosts, contracts need an AI-agent clause and a hard breach notification deadline, measured in hours rather than “promptly.” Norforge found more than 20 exposed Cairn instances it considers likely malicious, which means the next campaign is already running while you negotiate.

Detection cadence: matching monitoring speed to attacker speed

A weekly vulnerability scan and a monthly review cannot see something that starts and finishes inside a day. Continuous external attack surface monitoring, alerting on new subdomains, changed certificates, and unexpected logins, costs less than one annual pen test for most mid-size manufacturers. Keep the pen test. Stop treating it as detection.

Then run a tabletop where the attacker never sleeps, never gets bored, and probes forty entry points at once. Ask who approves taking a customer-facing portal offline at 3am, and how you prove to an auditor that quality documentation was untouched. If the answer involves waiting for someone to read an email in the morning, you have found the gap worth fixing first.

Defensive Agents: Using the Same Technology on Your Side of the Line

Norforge did not find this campaign through a quarterly review. They found it by watching exposed infrastructure at scale and reading what the agents were writing about themselves. That is an AI-assisted detection play, and it is available to you.

Where agentic monitoring beats periodic manual review

Manual review is sampling. An agent loop is coverage. The difference matters most in the places nobody checks between audits: TLS certificates on forgotten subdomains, CMS versions on microsites, DNS records pointing at infrastructure a vendor decommissioned last year.

• Configuration drift: Daily diffs against a known-good baseline across every domain you own, not the twelve your team remembers.
• Log triage: Agents cluster and summarise alerts so analysts read fifteen incidents instead of four thousand lines.
• Vendor site monitoring: Watch the warranty portal and parts catalogue your partners run, because that is where these breaches landed.
• Written findings: Every check produces a dated record you can hand to an auditor or a customer.

Measure this in two numbers. Analyst hours recovered per week, and mean time to detection on your peripheral web estate. If detection still takes longer than the roughly 23 hours those agents needed to finish a breach, you are not ahead.

Guardrails: scoped access, logged actions, human approval gates

Defensive agents get read access by default. Nothing else. A monitoring agent with write permissions on production is a second attacker you are paying for.

Three rules hold up in practice. Every action logs to an immutable store. Anything touching production, firewall rules, DNS, certificate issuance, waits for a named human to approve. And the agent’s scope is reviewed monthly, because permissions creep quietly once people start trusting the output.

Planning for a 2026 Where Attack Volume Is No Longer Budget-Limited

Norforge says it is working to get the malicious Cairn instances taken down. Good. That removes this operator’s infrastructure, not the method. Cairn’s creator, who goes by @le1xia0, has said the platform “was never a ‘hack” tool, and that is probably true of the next five frameworks too.

Plan for supply, not intent. When the cost of running a campaign drops to one person and a few lines of instruction, the number of people willing to try goes up, and the quality bar for who counts as a threat goes down. Budget forecasts built on last year’s attack volume will be wrong in a direction you cannot fix mid-year.

The governance questions to put on the next leadership agenda

Put these in front of the executive team as business questions, not IT questions. Who approves a new externally facing web property, and does that approval include a decommissioning date? Which vendors can publish under our brand, and what happens contractually when they are breached? How long would it take us to answer a journalist asking whether a named site is ours?

Then ask the one that matters most: is anyone accountable for the gap between how fast we adopt AI internally and how fast we govern it? Most manufacturers have a team piloting agents in procurement or quality documentation and nobody mapping the same technology onto the threat side.

Treat agent governance the way you treat process control. Defined owners, documented change control, evidence you can show an auditor. The firms that handle this shift with the least disruption will be the ones that already run their quality system that way and simply extend it.

Source: theverge.com