Norforge: AI agents breached John Deere, SharkNinja sites

The findings put a spotlight on a less-discussed side of AI-enabled cyberattacks: not custom-built malware, but existing open-source tools repurposed at scale. Cairn was designed as a general-purpose problem-solving engine where users define a start and end point and AI agents document their progress. Norforge's discovery shows the same setup can be turned into an attack orchestrator when an instance is left exposed, with one attacker standing out as the most active among those found.

The reported victims span the US, Canada, Australia and Japan, according to Reuters, and include household industrial and consumer names such as John Deere, SharkNinja and Cummins. Their responses differ: John Deere said there is no indication sensitive information was accessed, SharkNinja said a standalone product-support site was affected and contained, and Cummins said it is investigating a potential attack on a site run by a third-party vendor. Cairn's creator, @le1xia0, has pushed back, saying the platform was never a hacking tool and that misuse is a human decision rather than a feature of the engine.