Ledger / 25 Sep 2026
Chinese-speaking operator uses Cairn agents to breach company websites
Confirmed
NorForge examined exposed agent execution records and independently validated compromises. The underlying model configuration was not independently confirmed.
- Model
- DeepSeek, Claude CodeDeepSeek · openness unknown; Anthropic · closed
- Agent harness
- Cairn, Claude Codeopen-source harness
- Attributed country
- Chinalanguage or infrastructure clues only
- Sectors hit
- retail, manufacturingE-commerce and corporate websites, including Deere, SharkNinja and Cummins-associated…
Beginning September 25, an operator delegated website exploitation to Cairn agents. A worker identifier suggested Claude Code with DeepSeek V4.1 Flash.
Sources
- Hacker uses AI agents to breach over 100 company websitesTech Wire Asia · 21 Oct 2026
- Date
- 25 Sep 2026
- Disclosed
- 21 Oct 2026
- Actor
- Unnamed Chinese-speaking operator (criminal), as attributed by Tech Wire Asia
- Targets
- E-commerce and corporate websites, including Deere, SharkNinja and Cummins-associated sites
- What the AI did
- Recon, Vuln research, Agentic intrusion
- Model as named
- DeepSeek V4.1 Flash, Claude Code
- Model basis
- inferred
- Autonomy
- autonomous
- Outcome
- Researchers reported more than 100 affected companies and independently validated server compromises; the extent of data theft remained unclear.