Autonomous AI Hacking: What Cairn and ECHOTRIBBLE Reveal

Autonomous AI hacking is no longer a lab demo. In a Reuters exclusive on October 19, 2026, a researcher described watching one hacker's AI agents work for days with almost no human help. The agents tried more than 1,200 websites. Over 100 companies had sites breached.

On the same day, The Intercept reported that the US Army wants AI agents of its own that can attack networks "with minimal human oversight." Both stories raise the same question. What happens when people hand the hard parts of hacking to software that decides its own next step?

Disclosure: Van Data Team builds with Claude and other models, and this article was researched with Claude. Anthropic's Claude Code is named in the reporting, so we've stuck closely to the sources and marked what's confirmed and what isn't.

Key Takeaways

• A researcher at NorForge found more than 20 exposed control panels for Cairn, an open-source AI agent platform. They showed hackers' agents working with very little human input.
• In one cluster, agents tried more than 1,200 websites and reached sites at more than 100 companies, including Deere, SharkNinja and Cummins. How much data was taken isn't known.
• Successful break-ins took about 23 hours each. The researcher's cost estimate, about $50 each, is rough and unmeasured.
• The US Army's ECHOTRIBBLE plan calls for attack agents with "minimal human oversight." It's early, and no working tool has been shown.
• For defenders, the big lesson is visibility. Agents find the forgotten systems people miss, so you need to find them first.

Autonomous AI Hacking at a Glance

Here are the two stories side by side. Each row comes from the linked reports.

Detail	Cairn campaign	ECHOTRIBBLE
Who	A Chinese-speaking criminal hacker, per Reuters	US Army Cyber Command
Reported by	Reuters and NorForge, October 19, 2026	The Intercept, October 19, 2026
Status	Active since about September 25, 2026	Early stage; proposals requested in July 2026
Human role	A short instruction, then agents worked for hours alone	Set starting triggers, then "minimal human oversight"
Scale	1,200+ sites tried, 100+ companies' sites reached	Not known
Main concern	Cheap, patient attacks on ordinary companies	Damage to civilian networks along the way

What Happened in the Cairn Campaign

The story starts with a mistake by the attackers. Snorre Fagerland, principal threat researcher at NorForge, found Cairn control panels left open on the internet. Through them, he could watch hackers' agents pick targets, test weaknesses and report back.

According to Reuters, one Chinese-speaking hacker began targeting online stores in the US, Canada, Australia and Japan around September 25. The hacker's instructions to the agents were under 100 Chinese characters. After that, the agents did most of the work themselves.

• Attempts: the agents had tried more than 1,200 sites by late the week before the report.
• Results: they reached websites at more than 100 companies. Reuters named Deere, SharkNinja and Cummins.
• Time: successful break-ins typically took about 23 hours.
• Cost: Fagerland estimated about $5,000 in AI usage, or roughly $50 per successful break-in, though NorForge stresses that the figure rests on assumptions rather than real usage data.

Harm varied a lot. Deere said it took "necessary remediation actions" and saw no sign that sensitive data was accessed. SharkNinja said the affected site held only product support information and the threat was contained. Cummins said it was looking into a possible attack on a site run by a third-party vendor.

Two smaller businesses confirmed they had been hit. Others on the list didn't respond. Reuters couldn't determine how much data, if any, was taken.

We covered the cost side of this case, and a separate campaign Gambit Security reported in September, in AI agent attacks now cost $25. Here, the question is different. What does autonomy change?

What NorForge Saw Inside the Exposed Panels

NorForge's full write-up goes further than the news story. It groups the panels into three clusters of activity, and the largest one alone ran more than 1,100 attack projects across its panels.

A few findings stand out:

• Success was the exception. NorForge estimates an average success rate of about 10%. Many other projects gathered information that could help later.
• Projects were long. Successful ones averaged a little under 23 hours and collected about 140 facts each. One ran for more than five days.
• Costs are rough. NorForge had no real usage data. It estimates an average task at around $5, with long ones above $100, and warns the figures "could be off by a clear margin."
• The panels leaked secrets. They held target names, weaknesses found and hundreds of stolen keys and passwords. About 11% of the keys tested as valid.

NorForge says it's working with Reuters to notify victims and is trying to get the panels taken down. It redacted panel addresses and stolen data in its public report. That's the right call.

How Autonomous AI Hacking Differs From Older Automation

Attackers have used automated scanners for decades. Those tools run a fixed list of checks and stop. What's new is software that reads the result of each step and decides what to try next.

Cairn is built that way. A person gives it a starting point and a goal. Agents write what they learn on a shared project board, and the next agent picks up from there. A human can add hints, but doesn't have to.

Reuters describes what that looks like in practice. In one case, agents found no weakness in a company's main app. Instead of giving up, they looked through public records for related systems, found an exposed control panel and kept testing it for hours until it gave way.

That's the shift. Scanners find known holes. Autonomous agents keep looking for a way around, the way a patient human would, but across hundreds of targets at once.

Which Tools and Models Were Involved

Which AI did the work? That question has drawn a lot of attention, so it's worth being precise. NorForge saw one hacker's tasks run under a worker named for Claude Code and DeepSeek V4.1 Flash. It reads that as Claude Code acting as the agent harness, with a DeepSeek model doing the reasoning underneath.

That's an inference. It isn't confirmed.

Reuters wrote that the campaign "appeared to use a mix" of DeepSeek and Claude Code. A second cluster used a different agent framework with DeepSeek models reached through OpenRouter. We cover that model in DeepSeek V4.1 Flash 1017.

We didn't find a public statement from Anthropic or DeepSeek about this case. Anthropic has said in other cases that it bans accounts it catches misusing its tools, but we couldn't confirm any action here.

The wider lesson isn't about one vendor. Agent harnesses can usually be pointed at many models, including open ones that run on hardware the attacker controls. Safety rules in any single model or app only go so far.

ECHOTRIBBLE: The Army's Plan for Autonomous Agents

The second story comes from the other side of the law. The Intercept reports that US Army Cyber Command is working on ECHOTRIBBLE, a program to build AI agents for offensive cyber missions.

According to documents shared with vendors, the agents would:

• Move on their own through computer networks to find and "neutralize" targets, which the documents define as disabling them for a time, for good, or deleting them.
• Spread between devices, copying themselves onto other machines, including cloud and "air-gapped" systems.
• Work quietly, reporting back only a little and removing themselves when done.
• Need little supervision. The Army can set starting triggers, but the software must operate with "minimal human oversight."

The program is early. According to Help Net Security, a public notice asked companies for proposals in July 2026. It's not known whether a working tool exists.

Some outlets reported that a bid had been picked, but we couldn't confirm that. Army Cyber Command didn't answer The Intercept's questions.

Why Oversight Is the Real Issue in Autonomous AI Hacking

Put the two stories together and a pattern appears. In both, the selling point is that people don't have to watch every step. That's also the risk.

Experts quoted by The Intercept warn that a self-directed attack agent could pass through civilian networks on its way to a target. They gave a US water utility or a small business as examples. One asked the question plainly: "The target may well be hit. But what path will it take?"

The criminal case shows the same problem at a smaller scale. Agents that couldn't get into a company's main app went looking for related systems instead. A vendor-run site or an old support page can become the way in, whether or not anyone chose it as a target.

Autonomy also blurs who decided what. When an agent picks its own next step, it's harder to say which harm a person intended. That matters for the law, for insurance and for how governments respond.

Who Is Responsible When Open Tools Are Misused

Cairn is open source, with about 4,200 stars on GitHub. Its README calls it a general problem-solving engine and says penetration testing was the first area it was tested on. It also says it should only be used where you have "explicit authorization to operate."

Its author, who goes by le1xia0 on X, said the platform "was not designed for hacking attacks," according to Reuters. That's a familiar debate in security. Most testing tools can be used to protect your own systems or attack someone else's.

We think the answer isn't to ban open tools. Defenders use the same software to test their own systems, and attackers would switch to private copies anyway. The better focus is on safe defaults: tools that don't expose their dashboards to the internet, that log who ran what and that make authorization checks part of the setup.

The Exposed Panel Problem: A Lesson for Red Teams

The most useful detail for many companies is easy to miss. NorForge says some of the exposed panels looked like legitimate red-team setups, the kind security firms use to test clients with permission. Leaving those open could put the clients' own weaknesses and secrets on public view.

If you hire a firm that uses AI agents for testing, its tooling now holds a map of your weak spots. Ask how it protects that map:

• Is the dashboard private? It should sit behind single sign-on, never on the open internet.
• What gets stored? Findings, keys and passwords should be kept to a minimum, encrypted while stored and deleted as soon as the test and any retest are finished.
• Who can see it? Access should be limited to the named testers on your engagement.
• How will you know? The firm should agree in writing to tell you within a set time, such as 72 hours, if its own testing systems are ever exposed.

The same applies to any AI agent dashboard your own team runs. The attackers in this story were caught because they left theirs open. Don't make the same mistake with yours.

How Autonomous AI Hacking Changes Defense

The weaknesses in these cases weren't exotic. NorForge lists familiar types: weak sign-ins, pages that need no login, unsafe file uploads and poor handling of user input. What changed is the patience and the scale: agents can test the same old weaknesses for hours on end, across hundreds of sites at once, without anyone watching each step.

That shifts defense in three ways:

• Forgotten systems matter more. Agents search public records for anything linked to a company. Old test sites, support pages and vendor-run sites all become targets.
• Slow patching costs more. If a break-in takes about a day, a monthly patch cycle leaves weeks of open doors.
• "Nothing happened" isn't proof. NorForge advises treating any site that was tested as possibly exposed, even if the test seemed to fail. Agents often gather information first and come back later.

None of this needs AI-powered defense to start. It needs a full list of what you run, fast patching and someone who reads the alerts.

Find Your Forgotten Systems First

Since agents hunt for related systems, the best first step is to find them before an attacker does. Most companies have more public systems than their asset list shows.

• List every domain and subdomain you own, including ones set up for old campaigns, test projects and events.
• Check public certificate records. They often show subdomains people forgot.
• Include vendor-run sites that use your name, such as support portals, stores and booking pages.
• Give each one an owner. If nobody owns it, either assign someone or take it down.

Repeat the check every quarter. New systems appear faster than most lists get updated. Our AI agent incident response playbook covers what to do if you find one that has already been touched.

What to Watch for in Your Logs

Autonomous agents are patient, which leaves traces. Duration is the clue. Look for activity that runs for hours or days, not minutes. Signs worth an alert include:

• Steady probing from one source over a long stretch, with small changes between tries.
• Interest in admin and control pages that normal visitors never visit.
• File uploads or unusual requests to pages that rarely get them.
• New accounts or settings changes that nobody on your team made.

Also check for leaked secrets. The Cairn panels held hundreds of stolen keys and passwords. If you rotate keys on a schedule and alert when an old one is used, a leak does far less harm.

Rules for Your Own Autonomous Agents

ECHOTRIBBLE is a military program, but the oversight questions apply to any company that runs AI agents with real access. Good practice looks much the same:

• Set a clear scope. Each agent should know which systems it may touch and which it may not.
• Limit time and spend. Put caps on how long an agent can run and how much it can spend.
• Keep a human on risky steps. Require approval before an agent deletes, sends or changes anything important.
• Log everything. Keep a record of every action each agent took, the data it touched and the reason it gave, so you can rebuild events after a problem.
• Keep a stop button. Make sure someone can pause or shut down any agent quickly.

Our guide to designing AI agents with human review loops goes deeper on where approvals help and where they just slow things down.

Questions to Ask Before Hiring an AI Testing Firm

Many security firms now sell AI-driven testing. Used well, it helps defenders find holes before attackers do, and it can cover far more ground than a small human team could in the same week. Before you sign, ask:

• How much of the test runs without a human? And who reviews findings before they reach you?
• How do you limit scope? Ask how the agents are kept away from systems you didn't approve.
• Where do findings live, and how long do you keep them?
• Have your own tools ever been exposed? Ask how you would find out if they were.

Clear answers are a good sign. Vague promises about "autonomous security" are not.

Autonomous AI Hacking: Our Take

The Cairn case is a clear sign of where attacks are heading. One person with a short instruction could keep agents testing hundreds of companies for weeks. Most attempts failed. But the ones that worked needed little skill from the person running them.

ECHOTRIBBLE shows that governments are moving in the same direction, and that the people building these agents openly want less human supervision, not more. That makes rules for oversight more urgent, not less. Agents that pick their own paths can cause harm nobody planned, and today there are few clear rules on who answers for it when they do.

For most companies, the response is practical rather than dramatic. Know every system you have online. Patch fast.

Keep dashboards and admin pages private. Rotate secrets. And put the same limits on your own agents that you'd want on anyone else's.

How Van Data Team Helps Teams Prepare for Autonomous AI Hacking

We help companies use AI agents safely and defend against them. That means mapping which agents you run and what they can reach, setting scope and spend limits, adding human approval for risky steps and testing agents against misuse before they go live.

If this is on your list this quarter, start with our posts on agentic AI security and AI governance, or see how we approach AI agent evaluation security.