Hackers' AI agents are no longer a conference-talk hypothetical. On Monday, cybersecurity firm NorForge published findings on exposed control panels for an AI-driven penetration-testing system called Cairn — panels it assesses as connected to malicious operations against real companies. "Give it a target and an objective," NorForge says of the system, "and it can coordinate AI agents to investigate the target, search for security weaknesses, and attempt to break in."
What Cairn is, and what 'exposed' means
Penetration testing is a legitimate profession: companies hire specialists to attack their own systems so the weaknesses are found by friends first. Tools that automate parts of that work — scanning, probing, chaining small flaws into a path in — are a normal part of the trade, and AI agents that coordinate the work are the trade's obvious frontier. Cairn, as NorForge describes it, sits at that frontier: a control system that takes a target and an objective and dispatches agents to investigate, find weaknesses and attempt intrusion. The scandal in Monday's report is not the tool's existence but its operational hygiene. A control panel left exposed on the internet is the equivalent of a burglar's workshop with the door open and the lights on: it reveals targets, methods and sometimes results to anyone who looks — including, in this case, a threat-research firm. NorForge's assessment that 20-plus exposed panels were likely tied to malicious operations converts a product story into a crime story: these were, in its judgment, live operations against real companies, run through infrastructure their operators failed to secure.
The targets answer
Reuters did the shoe-leather work of identifying targets and asking them. Deere said it had taken "necessary remediation actions" and had no indication that sensitive information was accessed. SharkNinja said the incident involved a standalone product-support site and was contained. Cummins appears in the reporting as an identified target. Read the three data points together and they describe the current state of corporate exposure honestly: a farm-equipment giant, a consumer-appliance brand and an engine manufacturer — not banks, not defence contractors — in the sights of agent-driven intrusion tooling. That breadth is the point. When the marginal cost of attacking a website falls toward the cost of computing, the set of worthwhile targets expands to everyone with a website, including the support site for a vacuum cleaner. Deere's and SharkNinja's responses also model the new disclosure grammar: remediation confirmed, sensitivity denied or bounded, containment asserted. Whether those assurances survive forensic scrutiny is a question for the coming weeks, not Monday's reporting.
Why this matters
The asymmetry is the story. Defensive security has spent two years absorbing AI as an assistant — triaging alerts, summarizing logs, drafting patches — while the offensive side, as Monday's report shows, has absorbed it as labour: agents that work targets in parallel, at machine speed, without salaries or sleep. A human intrusion team is a scarce, expensive, sequential resource; an agent swarm is none of those things, and its existence changes the economics for both sides. Defenders must now assume continuous, patient, adaptive probing of every public surface they own — not the annual pentest, not the quarterly scan, but a standing adversary that never clocks out. The exposure finding cuts the other way too, and offers the one comfort in the report: the operators of these systems are making beginner's mistakes, leaving their command infrastructure open to the same internet they hunt on. "It's a new world now" is a warning, but the panels' exposure is evidence the new world's criminals are as sloppy as the old one's. The practical agenda for companies is unglamorous and urgent: inventory every public-facing property including the forgotten support sites, monitor for agent-pattern probing, and treat the security of offensive tooling — your own pentest infrastructure — as part of your attack surface. Signal Post News's coverage of this week's other agent-age incident, the Claude tool that tripped Meta's defences, and of the White House AI incident reporting mandate completes a triptych: in a single week, AI agents have been the intruder, the false alarm and the regulated entity.
What happens next
Expect three developments. First, attribution and takedown: exposed panels are evidence, and law enforcement and hosting providers tend to act on published indicators — some of the 20-plus operations NorForge catalogued are likely to go dark or be seized, and follow-on reporting usually names more targets. Second, disclosure: companies that find themselves in the target lists will face the Deere–SharkNinja choice between a bounded statement now and a worse one later. Third, the policy echo: autonomous offensive agents were the scenario regulators cited when they built AI incident reporting regimes, and a documented case against named Fortune-list companies converts that scenario into an exhibit. NorForge's full findings, and any response from Cairn's makers about who was supposed to be operating their system, are the documents to watch.
Sources: NorForge findings published October 19, 2026, via PYMNTS and Reuters (exposed AI-driven penetration-testing control panels; the Cairn system description; 20+ exposed panels assessed as likely connected to malicious activity; Snorre Fagerland quoted). Reuters, October 19, 2026 (independent identification of targeted sites including Deere, SharkNinja and Cummins; Deere's remediation statement; SharkNinja's statement that the incident involved a standalone product-support site and was contained).