Single-Person Cyber Attack Campaign Using Artificial Intelligence Agents

According to a report published Monday by cybersecurity firm NorForge, a single Chinese-speaking hacker conducted a large-scale cyber attack campaign targeting e-commerce sites in North America, Australia, and Japan using artificial intelligence agents via the open-source Cairn platform.

According to the report published by cybersecurity firm NorForge, in the campaign that began on September 25, the hacker targeted over 1,200 sites across the US, Canada, Australia, and Japan. As a result of the attacks, data, credit card numbers, and cryptocurrencies from more than 100 businesses were seized. It was stated that these attacks, which had a success rate of approximately 10 percent, lasted an average of 23 hours.

The main tool used by the hacker in the operations was the open-source Cairn platform, accessible via GitHub, which provides AI problem solving and state management. The NorForge report stated that the underlying AI models behind Cairn consist of a mixture of China-based DeepSeek and Anthropic's Claude Code software. It was estimated that the token cost of the operation was approximately $5,000, amounting to a cost of $50 per successful breach.

The developer of the Cairn platform, a user with the handle @le1xia0, stated on the X platform, "Cairn is actually an innovative multi-agent architecture and is not designed for hacking attacks. If it is used for malicious cyber attacks, this is not my intention."