The BaseNewsThe Verge

A hacker broke into John Deere and SharkNinja with an army of AI agents

The Verge reports that security firm Norforge found a hacker who broke into more than 100 websites using AI agents on the open-source Cairn platform. Reuters names John Deere, SharkNinja and Cummins as victims. Norforge found more than 20 exposed Cairn instances it considers likely malicious.

Open the source ↗

Why it matters

The same thing, for different readers.

What it means for you

Companies whose products people use, such as John Deere and SharkNinja, had websites broken into by a hacker who let AI agents do most of the work.

For lawmakers

Norforge's finding that attackers can direct AI agents with a short instruction shows open-source agent platforms can be turned to attacks.

For researchers

Norforge found the attacker's intrusion tactics were set out in fewer than 100 Chinese characters, with successful breaches taking about 23 hours, according to Reuters.

The question it raises

Cairn's creator says misuse is a human decision, not a feature of the engine, which raises where responsibility lies for tools that can be used for attacks.

In their own words

Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.

From the source’s own text.

“A hacker broke into more than 100 websites using an army of AI agents that mostly operated on their own, according to findings from the AI security firm Norforge.”
The VergeThe Verge's opening report of Norforge's findings.
Found word for word in the source
“misuse is a human decision, not a feature of the engine.”
@le1xia0, Creator of CairnCairn's creator, earlier in October, rejecting the idea that the platform is a hacking tool, as quoted by The Verge.
Found word for word in the sourceAs quoted in the text we read, not the speaker’s own text or a transcript of their words

The record

Questions
How is AI used in attacks, defence and war? · Can AI systems act beyond what people intended or allowed?
People
Emma Roth (Wrote it, News Writer, The Verge) · @le1xia0 (Speaks, Creator of Cairn) · Melinda Koski (Mentioned, Spokesperson, Cummins)
What we read
We read the whole source.
Found by
The Radar, run of October 20, 2026, via the-verge-ai (tier 2: a major outlet’s own reporting)
Cite this
The Verge, “A hacker broke into John Deere and SharkNinja with an army of AI agents”, October 19, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/verge-2026-10-19-ai-agents-hack-john-deere
Our notesVictim names, the 23-hour figure and the Chinese-character detail come from Reuters as relayed by The Verge; Norforge does not name targets. John Deere said no indication sensitive information was accessed; SharkNinja said the breach hit a standalone product-support site and is contained.