Ordinary criminals now have access to advanced artificial intelligence hacking tools that were once only available to state-level cyber groups, according to new findings by cybersecurity firm NorForge.
AI-powered attacks shift from governments to individuals
In September 2025, Anthropic, a leading AI company, reported detecting a cyberattack campaign that relied on its Claude Code tool. Anthropic attributed the attack to a group believed to be backed by the Chinese government, targeting around 30 large organizations, including technology firms, banks, chemical manufacturers, and government entities. According to Anthropic, AI completed about 80% to 90% of the workload in these incidents, with human intervention required mainly at critical decision points.
Anthropic emphasized that this was the first well-documented case of a cyberattack executed primarily by AI and highlighted that Claude sometimes introduced inaccuracies, necessitating human verification. The company made the findings public on November 13, 2025, and noted that the attack’s direct success was limited to a minority of cases.
A year later, NorForge published a detailed report revealing that similar attack campaigns are now within reach of everyday criminals, thanks to free or low-cost AI tools. Snorre Fagerland, a cybersecurity researcher with nearly three decades of experience, led the investigation after seeing prior research about groups using open-source AI tools such as Hermes, Strix, and Cairn.
Cairn, the free tool at the center of the investigation, operates by using AI agents that can automatically scan assigned targets for vulnerabilities and attempt to gain unauthorized access. The easy accessibility of Cairn means anyone can deploy it by simply providing a target and objective.
Mini dictionary: Cairn, Hermes and Strix are open-source AI tools designed for automating cybersecurity tasks. While originally intended for research and legitimate security testing, these platforms have been misused by malicious actors to conduct automated hacking operations. Cairn, in particular, enables users to run fully autonomous attack scenarios with minimal technical skills.
Many operators left Cairn’s web-based control panels exposed to the public internet. Using scanning services like Shodan and Censys, the NorForge team identified more than 20 panels believed to be linked to criminal activity. These panels displayed details such as chosen targets, discovered vulnerabilities, and lists of stolen passwords and access keys. NorForge withheld specific data and the web addresses to prevent further abuse until the panels are removed.
Targeted companies and scope of breaches
Investigative journalist Raphael Satter matched activity from one panel to several well-known companies. The most active panel operator used Chinese language settings and directed AI agents to attack more than 100 organizations, including US-based tractor manufacturer Deere, home appliance producer SharkNinja, and engine maker Cummins.
Starting September 25, the attackers targeted over 1,200 retail websites in the United States, Canada, Australia, and Japan. Each successful intrusion took approximately 23 hours of continuous automated probing, while the hackers themselves did minimal manual coding, using instructions limited to under 100 Chinese characters.
Deere confirmed it had implemented measures to address the threat, stating there was no evidence that sensitive data was accessed. SharkNinja reported that the breach was isolated to a separate product support site, which has since been secured. Cummins said it was investigating a potential incident related to one of its external vendors.
Deere asserted that it “has no indication that sensitive information was accessed,” and SharkNinja emphasized that the incident was contained to a support website, with no impact on main operations.
NorForge’s findings indicate that the largest group of attackers, labeled AIA0001, runs more than 1,100 attack campaigns primarily against online retail and payment systems in the United States, Japan, and Australia, aiming for persistent unauthorized access. Other groups focused on stealing large troves of credit card information and targeting cryptocurrency exchanges with AI-powered attacks.
| Company | Nature of Target | Status of Response |
|---|---|---|
| Deere | Tractor manufacturing, US | Secured, no sensitive data accessed |
| SharkNinja | Consumer appliances, US | Breach at support site, contained |
| Cummins | Engine production, US | Investigating incident via vendor |
Industry and regulatory reaction
Cairn’s developer, known as “le1xia0” on social platforms, responded to the controversy by stating that Cairn was intended as an “innovative type of multi-agent architecture” and not designed for malicious attacks.
The impact of automated hacking has also prompted action from US regulators. On October 14, the Federal Trade Commission issued subpoenas to both OpenAI and Anthropic following recent security incidents. In parallel, Anthropic has submitted a draft legislative proposal to Congress, suggesting that the US government be empowered to block deployment of any AI models that could potentially result in $1 billion or more in damages.
OpenAI and Anthropic continue to disclose cases involving the misuse of their AI technologies, reflecting heightened industry concern as criminal groups increasingly incorporate advanced AI tools into their operations.
Anthropic and OpenAI are now regularly reporting instances where their AI models have been co-opted for unauthorized and sometimes large-scale attacks.
