Security researchers have uncovered a new wave of cyberattacks powered by autonomous AI agents that can operate without human direction. A hacker deployed an army of these agents, mostly running on their own, to breach more than 100 websites, including the targets of John Deere, SharkNinja, and Cummins, according to Reuters. The intrusions were traced to exposed work on Cairn, an open-source AI platform that functions as a “general-purpose problem-solving engine.” Here’s what it means.
The Rise of Agentic AI
Artificial intelligence has long been used as a tool, responding to prompts or classifying data. Agentic AI, by contrast, can make decisions and pursue goals independently. As the Wikipedia entry on AI agents explains, these programs can “make decisions, pursue goals, and take actions independently of human programmers.” While the theoretical groundwork for such agents stretches back to the mid-twentieth century, the technology exploded into practical use late last year. The availability of OpenAI’s “function-calling” API and Anthropic’s Model Context Protocol gave agents the ability to interact with external tools and the real world at scale. The term “agentic” only entered frequent use in 2024, popularised by researcher Andrew Ng.
In this new paradigm, an agent is given a start point and an end point. The system documents its progress as it moves toward the goal. Researchers at Norforge discovered that hackers were exploiting this structure. With Cairn, users set a beginning and an end for the AI agents, which then document their own progress. However, as Norforge notes, the same mechanism allows malicious actors to orchestrate cyberattacks. The hacker identified as the “most active” among the exposed instances laid out “preferred intrusion tactics” using fewer than 100 Chinese characters. Once set in motion, the agents pursued these tactics autonomously.
Attacks in Numbers
The scale of the operation is striking. Norforge reported that a single hacker used an army of AI agents to break into more than 100 websites. The victims, confirmed by Reuters, included John Deere, SharkNinja, and Cummins. John Deere told Reuters there was “no indication that sensitive information was accessed,” while SharkNinja said the breach affected a standalone support site and has since been contained. A Cummins spokesperson said the company is investigating a potential attack on a website operated by a third-party vendor.
According to Reuters’ analysis of the exposed instances, successful breaches took about 23 hours from start to finish. Norforge also found more than 20 exposed Cairn instances that are “likely malicious” and spread across multiple countries, including the US, Canada, Australia, and Japan.
How the Intrusion Worked
The mechanism was straightforward, if effective. The attacker used Cairn to orchestrate cyberattacks by setting a start and end point for the tasks. The AI agents then executed the work with minimal human involvement. The most active attacker documented preferred intrusion tactics in a brief string of Chinese characters, which the agents followed. Because the agents operated independently, they could scan for vulnerabilities, attempt logins, and move laterally through systems without waiting for instructions.
Norforge’s findings suggest that the danger lies in the autonomy. Traditional cyberattacks often require a human to type commands, select targets, and adjust tactics in real time. Agentic AI removes that need. Once the parameters are set, the agents can work around the clock, adapting their approach as they go. The 23-hour breach window illustrates how quickly an autonomous agent can achieve its goal once unleashed.
Defending Against Autonomous Agents
In response to these threats, security firms are turning to hardware-based protections. NVIDIA Sentry provides host-isolated runtime protection for AI agents, ensuring they stay within their designed intent. The framework runs on NVIDIA BlueField-4 DPUs, which sit on the node’s only path to the model. This hardware trust domain governs all agent network communications, creating a strict boundary that the agent cannot cross without detection.
DOCA Tower, a component of NVIDIA Sentry, operates as a transparent proxy for agent traffic. It places an inspection layer between the agent and the external environment, monitoring every request and blocking anything that falls outside the agent’s permitted scope. Memory introspection adds further context, examining the agent’s execution environment—such as a container or microVM—to detect external threats or misbehavior. By separating policy enforcement from the agent workload, these systems ensure that a compromised agent cannot alter its own restrictions. The practical upshot is that enterprises can deploy agentic AI for legitimate tasks while maintaining control over how those agents interact with the wider world.
Geographic Spread of Exposed Instances
Norforge’s investigation revealed that the threat landscape extends across multiple continents. The security firm identified more than 20 exposed Cairn instances that are “likely malicious,” with activity traced to the United States, Canada, Australia, and Japan. This global distribution indicates that the vulnerability is not confined to a single region or sector. Enterprises in North America, Oceania, and Asia were all within the crosshairs of the autonomous agent network. The breadth of the exposure underscores the difficulty in attributing and mitigating attacks that originate from distributed, independent nodes.
Reuters’ corroboration of the targets further highlights the international scope of the breach. While the initial intrusions focused on major industrial and consumer brands, the underlying Cairn instances were scattered across borders, suggesting a coordinated effort that leveraged geographic diversity to evade detection. The presence of malicious instances in Japan and Australia, alongside those in North America, points to a worldwide footprint that complicates traditional perimeter-based security responses.
Sources
- A hacker broke into John Deere and SharkNinja with an army of AI agents
- AI agent
- Inside NVIDIA Sentry: Secure AI Agents at Runtime | NVIDIA Technical Blog
Photo: FlyD / Unsplash (Unsplash License)
