ANALYSIS Two concurrent incidents this weekend confirm that AI-agent-driven cyberattacks have crossed from theoretical risk to operational reality, and that the defenders trying to fight back with the same frontier models are running into their own tools' safety guardrails.
Why it matters
A single Chinese-speaking hacker used autonomous AI agents to probe more than 1,200 websites and breach over 100 companies, including Deere, SharkNinja, and Cummins, at a total cost of roughly $5,000 in AI tokens3,6,8. Simultaneously, the open-source AI coding tool OpenCode disclosed that attackers broke into a legacy system and exposed API keys belonging to 1.4% of its Console users, with some developers reporting more than $1,700 in unauthorized charges overnight1,5. ◆ Taken together, the two events illustrate both sides of the same collapse: agents are cheap enough for attackers to deploy at scale, and the platforms developers use to store their AI credentials remain soft targets whose compromise feeds further attacks.
The big picture
The Cairn campaign, uncovered by NorForge principal threat researcher Snorre Fagerland, began around September 259,12. The hacker gave AI agents instructions in fewer than 100 Chinese characters, then let them autonomously scan, probe, and exploit e-commerce sites across the United States, Canada, Australia, and Japan. Successful intrusions took about 23 hours on average4. The campaign used DeepSeek and Anthropic's Claude Code. NorForge estimated the cost at roughly $50 per successful breach.
Fagerland discovered the operation almost by accident while scanning the internet for exposed deployments of Cairn, finding more than 20 publicly exposed control interfaces he considered likely malicious. Cairn's creator, who uses the handle @le1xia0, said the platform "was not designed for hacking attacks" and that harmful use reflects users' decisions rather than the engine's intent.
Deere said it had taken remediation actions and had no indication that sensitive information was accessed11. SharkNinja said the breach affected a standalone product-support website and that the threat had been contained. Cummins said it was investigating a potential cyberattack involving a website operated by a third-party vendor. Reuters said it could not determine how much information, if any, was stolen across all affected organizations10.
Between the lines
The OpenCode breach adds a second dimension. OpenCode co-founder Dax Raad described 48 hours of continuous defense, writing on X that attackers had been "non stop trying to attack our systems for the past 48 hours," and adding: "a side effect is everything is getting hardened but damn we basically need agents going 24/7 because that's what they have"13. When a developer asked whether frontier models' cyber safeguards had blocked his team during the incident, Raad's answer was blunt: "yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing".
ANALYSIS That exchange captures a structural asymmetry. Attackers face no refusal mechanisms when they route through open-source models like DeepSeek or repurpose agent frameworks like Cairn. Defenders working inside the safety boundaries of commercial frontier models hit guardrails at the moment they need the most aggressive investigative capability. OpenCode said it was working with Google, OpenAI, and Anthropic to address the incident.
The credential supply chain compounds the problem. GitGuardian research found that Claude Code-assisted commits leaked secrets at a 3.2% rate, versus a 1.5% baseline, and that researchers recovered real API keys from models including Qwen3-27B, GPT-Codex 5.3, and Claude Haiku 4.5 using only API output access7. ◆ Every leaked key is potential fuel for the kind of distillation attack OpenCode described, or for unauthorized compute charges like those its users absorbed.
Some skeptics pushed back on OpenCode's framing, arguing the incident was a straightforward breach whose use for distillation remains unproven. OpenCode described it as "a large-scale distillation attack" but did not specify the mechanism.
What's next
The Cairn campaign's exposure through an accidentally public control panel suggests other, better-hidden operations may already be running. Fagerland found more than 20 exposed Cairn interfaces; the number of unexposed ones is unknown. OpenCode said affected users have been notified and that it is coordinating with the three major API providers. Raad's call for round-the-clock defensive agents points toward a near-term arms race in which both sides of a breach are staffed primarily by autonomous software, with the humans left managing the models that do the actual work.