AI Security · Threat Intelligence
AI agents used to breach SharkNinja and John Deere websites
A hacker used AI agents to break into over 100 websites, including SharkNinja and John Deere. The attacks were mostly automated and exploited an open-source AI platform.
Ross GrantUpdated 2 min read
The short version
A hacker used artificial intelligence agents, programs that can act on their own, to break into over 100 websites. Companies affected include SharkNinja and John Deere. The attacks were mostly automated and used a tool called Cairn. So far, there is no evidence that customer data was stolen, but companies are still investigating.
What happened?
A hacker used AI agents to break into over 100 websites, including those belonging to SharkNinja and John Deere, according to The Verge. The attacks were mostly automated and used an open-source AI platform called Cairn. SharkNinja said the breach affected a standalone support site and has been contained. John Deere said there is no sign that sensitive data was accessed.
Who is affected
According to The Verge (opens in a new tab), the breaches targeted more than 100 websites. The companies named as victims include SharkNinja, John Deere and Cummins. The affected organisations are based in the US, Canada, Australia and Japan. SharkNinja said the breach hit a standalone product support site. John Deere said there was no sign that sensitive information was accessed. Cummins is investigating a possible attack on a site run by a third-party vendor.
How the attack worked
The attacks were carried out using AI agents, software programs powered by artificial intelligence that can operate with little human guidance. Researchers at the security firm Norforge found that the hacker used an open-source AI platform called Cairn. Cairn lets users set a start and end goal for an AI agent, which then works through the steps to achieve the task and documents its progress. In this case, the hacker used Cairn to direct the AI agents to break into websites. The instructions for the attacks were written in fewer than 100 Chinese characters. Each successful breach took about 23 hours, according to Reuters as cited by The Verge. Norforge found more than 20 exposed Cairn instances that were likely being used for malicious purposes.
The response
SharkNinja said it has contained the threat and that only a standalone support site was affected. John Deere told Reuters there was no indication that sensitive data was accessed. Cummins said it is investigating the incident involving a third-party vendor's website. None of the companies have reported financial losses or customer data theft at this stage. The Verge notes that John Deere and SharkNinja did not respond to its request for further comment.
What you should do
For organisations, this incident highlights the need to monitor for unusual automated activity and to review the security of any AI tools in use. Open-source AI platforms can be powerful but may also be misused if not properly secured. Security teams should audit access to such platforms and ensure that exposed instances are locked down or removed. Regularly check for signs of automated attacks and review logs for unexpected behaviour.
Why it matters
This is one of the first reported cases where AI agents were used to automate large-scale cyberattacks. It shows that open-source AI tools can be misused by attackers, making it harder for defenders to spot and stop threats.
Key points
- AI agents were used to automate attacks on over 100 websites.
- SharkNinja and John Deere were among the affected companies.
- The attacks used an open-source AI platform called Cairn.
- No sensitive data theft has been confirmed so far.
- Security teams should audit and secure AI tools to prevent misuse.
Sources
The Verge
Reference
