That string named the worker behind every task in a campaign that broke into more than 100 company websites in about three weeks. Snorre Fagerland, principal threat researcher at NorForge, published the findings yesterday, and Reuters identified Deere, SharkNinja, and Cummins among the victims. Deere said it had remediated and saw no sign that sensitive information was accessed. SharkNinja said the intrusion hit a standalone product support site and was contained. Cummins said it was looking into a report involving a site run by one of its vendors.
Most coverage leads with those three names. The worker name tells you more: a widely available agent harness, driven by a cheap open-weight model, did nearly all of the work.
The operator, who wrote in Chinese, used Cairn, an open-source platform that points a team of AI agents at a goal and lets them work toward it, posting findings to a shared board as they go. Per Reuters, the operator's preferred intrusion tactics fit in fewer than 100 Chinese characters. An automated pipeline fed in targets, mostly online shops in the US, Canada, Japan, and Australia. Each task told the agents to find a way to run code on the site and plant an uploader web shell, which NorForge reads as an effort to build lasting access to shop and payment systems for later use.
By late last week the agents had tried more than 1,200 sites. Successful breaches took a little under 23 hours on average. In one case, the agents found nothing exploitable in a large company's public application, tracked down a linked control panel, and after hours of trial and error got its server to run commands. Fagerland put the total spend at about $5,000 in tokens, roughly $50 per successful break-in, and told Reuters, "It's not script kiddie stuff."
NorForge reads that worker name as an agentic coding harness running DeepSeek V4.1 Flash, a low-cost open-weight model. The tooling came from one place and the reasoning came from another, and the reasoning layer is where refusals live. Hosted frontier models refuse offensive tasks, and their providers keep tightening those controls. With an open-weight model, the person running it decides what it refuses.
The same pattern showed up twice this summer. In July, a Chinese-speaking actor paired DeepSeek with an open agent framework to scan and exploit targets on its own, reportedly picking that model because Western platforms blocked the same requests. In August, TeamT5 reported that Chinese state-affiliated groups had more than doubled their attack volume after folding DeepSeek and other open-source models into their operations.
Each improvement in open-weight models reaches attacker pipelines the same week it reaches everyone else, and hosted-model guardrails can't follow a model once someone downloads it.
Lior Div named this the Cyber AI Parity Window earlier this year: for the first time in security, defenders and attackers got the same technology at the same time. Since then the window has picked up a deadline, and OpenAI has put its own timer on it. The race was always about who would put the technology to work first.
Attackers had structural advantages in that race that have nothing to do with talent. They don't run procurement or wait on a change advisory board. They don't need the model to be right; NorForge estimated about a 10% average success rate across the tools it observed, and at roughly $5 a task, nine misses cost about $45. With open weights, they don't need anyone's permission either.
Cairn's author built it as a general-purpose problem-solving engine and has said publicly it was never meant for hacking. Pair a platform like that with an open-weight model and you get an intrusion capability, whatever the builder intended.
None of this is a knock on the companies involved. A standalone product support site is the kind of asset every large enterprise has, spun up for a good reason by a team that has since moved on to other work. Finding those assets across 1,200 targets used to take more hours than any human operator had, and agents have the patience for it.
We talk with CISOs every week, and over the past year their question has moved from "does AI work in security operations?" to "how much time do I have?" The ones furthest along are putting AI agents into their SOC now, before it's standard practice, and they're putting real time into process and people alongside the technology.
SOC processes were built around human capacity. Tiering, sampling, and suppression rules exist because a team of people can't investigate everything, so someone decides what gets looked at. When agents investigate every alert, those decisions change. CISOs tell us they're rewriting runbooks around new questions: what evidence a human needs to see before signing off on a verdict, which actions an agent can take on its own and which wait for approval, and what "reviewed" means when the first pass happened in minutes.
A web shell upload alert on a low-priority site that waits in a queue overnight gives a campaign like this most of the 23 hours it needs.
An attacker paying $5 a task iterates far faster than a detection program on a quarterly review cycle. CISOs are using investigation outcomes to drive detection engineering. When every alert gets a full investigation, the results show which detections generate noise, which ones fire on real activity, and where coverage is thin. Suppression decisions can then rest on evidence about each detection's quality, where they used to rest on how many alerts the team could get through.
Analyst work is moving from executing investigation steps to supervising them. CISOs are investing in teaching their people to read an agent's reasoning, challenge a weak conclusion, and spot the context an agent missed, the same way a senior analyst reviews a junior's case. The time that frees up goes to threat hunting, root cause analysis, and the judgment calls that need a person, the work our CISO Israel Barak has written about wanting analysts back on. Humans stay on the loop, setting direction and owning the outcome.
The Cairn operator built a working intrusion pipeline out of open-source parts and $5,000 in tokens. Defenders have access to the same parts. The CISOs we're talking with have stopped debating whether to use them and are working through the harder questions about process and people, so that when a web shell lands on a forgotten support site at 2:00 AM, it gets a full investigation in minutes and a person sees the result before the attacker's agents finish their next step.
A Chinese-speaking operator used Cairn, an open-source multi-agent platform, with DeepSeek V4.1 Flash to attack more than 1,200 websites, according to NorForge research reported by Reuters on October 19, 2026. The agents broke into more than 100 companies, including Deere, SharkNinja, and Cummins. Successful breaches took a little under 23 hours on average and cost about $50 each in AI tokens.
With an open-weight model, the person running it decides what it refuses. Hosted frontier models block offensive tasks, but those guardrails can't follow a model once someone downloads it. Each improvement in open-weight models reaches attacker pipelines as quickly as it reaches defenders.
The Cyber AI Parity Window is 7AI CEO Lior Div's term for the period when, for the first time in security, defenders and attackers gained access to the same AI technology at the same time. The window narrows as attackers put that technology to work, and campaigns like the Cairn intrusions show that is already happening.
The CISOs 7AI talks with are putting AI agents into their SOC before it becomes standard practice, and they're working on process and people alongside the technology. They're rewriting runbooks so agents investigate every alert, using investigation outcomes to tune detections continuously, and training analysts to review agent reasoning, with humans on the loop.