Agentic Reasoning Applied to Offensive Security
19 October 2026 | BunCosmos Research Lab | AI agents and cybersecurity
For years, artificial intelligence in cybersecurity mostly meant assistance: explaining vulnerabilities, drafting scripts, summarizing logs, or accelerating analysis while a human decided what to try next. A campaign reported by Reuters on 19 October 2026 illustrates a more consequential shift. An attacker can give an agent system a broad objective and let it spend hours investigating, testing, adapting, and continuing with limited supervision.
Cybersecurity firm NorForge says a Chinese-speaking threat actor used autonomous AI agents to target more than 1,200 websites across several countries, with more than 100 compromises reported across the wider campaign. Reuters independently identified several affected organizations. NorForge reported that successful projects in the largest observed cluster reached their goals in a little under 23 hours on average. Software has automated attacks for decades; this investigation shows how adaptive, persistent reasoning can extend that automation.
From automated tools to agentic reasoning
Traditional security automation excels at repetition. Scanners test systems for known weaknesses, scripts follow predefined checks, and exploit frameworks automate manual tasks. Agentic systems can also respond when an expected route fails: collect facts, form a hypothesis, explore alternatives, evaluate results, and continue without a person specifying each next step.
That initiative is useful in ordinary work. Research agents choose sources, coding agents trace dependencies, and defensive agents investigate weaknesses. Directed at unauthorized targets, the same capabilities can help an attacker sustain several investigations at once.
What Cairn is, and why its architecture matters
The campaign was associated with Cairn, an open-source framework whose developers describe it as a general-purpose state-space search engine rather than a hacking product. Its basic idea is simple: the starting point is known, the desired end state is defined, and the path between them is unknown. Penetration testing is one example of that structure, but the same pattern can apply to vulnerability research, mathematical proof, capture-the-flag challenges, and other problems in which a system must discover its own route toward a clear objective.
Cairn uses a blackboard-style architecture built around two recurring elements: facts and intents. A fact is something the system has learned; an intent is a direction it has decided to explore next. Findings are written to a shared internal blackboard so that different workers can build on one another instead of repeatedly starting from zero. Human operators can also add hints, but the framework is designed to let multiple agent workers continue searching through the problem space on their own. Cairn's public repository lists Claude Code, Codex, and Pi as supported worker backends, underscoring that the orchestration layer and the underlying model are separate parts of the system.
The open dashboards that exposed the operation
NorForge did not discover the campaign by infiltrating a secret criminal network. It found something much more mundane: many Cairn control panels had been left exposed on the public internet. The researchers report that more than 20 exposed panels appeared likely to be associated with malicious activity, while other unsecured panels seemed to belong to legitimate red teams. Because the dashboards displayed project goals, discovered weaknesses, operator instructions, credentials, and agent progress, they offered an unusually detailed view into how autonomous offensive systems were being used in practice.
NorForge grouped the malicious activity into several clusters. The most active, labeled AIA0001, used Chinese-language instructions and appeared across 14 dashboards containing more than 1,100 attack projects. The targets were concentrated mainly in the United States, Japan, Australia, and Canada, and the apparent objective was persistent access to e-commerce and payment infrastructure that could later be monetized. NorForge assessed the cluster as financially motivated rather than obviously state-sponsored, which is an important distinction: a Chinese-speaking attacker is not the same thing as an operation attributable to the Chinese government.
How little the human reportedly had to say
Reuters reported that some task instructions were shorter than 100 Chinese characters. NorForge's screenshots and analysis show that the operator could provide a target and a high-level objective, after which the agent system generated its own sequence of reconnaissance, testing, and exploitation attempts. In the largest cluster, successful projects reached their goals in a little under 23 hours on average and accumulated roughly 140 facts per project, although individual runs varied widely and at least one lasted more than five days.
The human chooses the target and malicious goal, while the system performs much of the investigation between them. Long-running attempts can continue in parallel without an operator supervising every step.
Which models were involved?
NorForge repeatedly observed a worker label written as claudecode_deepseek-v4.1-flash. The researchers interpret this as potentially indicating a Claude Code harness using DeepSeek 4.1 Flash as the underlying model, while another cluster appeared to use the Pi framework with DeepSeek models through OpenRouter. Reuters therefore described the operation as involving tools such as DeepSeek and Claude Code. That wording must not be turned into a claim that Anthropic, DeepSeek, or their models independently chose to attack anyone; the malicious intent came from the human operators who assembled and directed the system.
The distinction between harness, model, and orchestrator matters. A coding harness provides tools and a working environment; an orchestration framework coordinates workers; the model generating decisions may come from another provider. A component label alone does not establish the identity or responsibility of the whole system.
The economics may be as important as the technical capability
Reuters reported an estimate of roughly $5,000 in model usage across the campaign, or approximately $50 per successful compromise. NorForge's own technical account is more cautious because the researchers did not have the attackers' billing records; they estimated that an average task, including unsuccessful and early-ending attempts, might cost around $5, while very long projects could exceed $100. The exact figures are uncertain, but the central economic point is difficult to miss: persistent autonomous work is becoming inexpensive enough that a single operator can afford to run many attempts at once.
That changes the arithmetic of cybercrime even if the agents are imperfect. An attacker does not need a 100 percent success rate if failed attempts are cheap, parallel, and largely unattended. NorForge estimated that the malicious deployments it observed were achieving roughly a 10 percent average success rate, with many unsuccessful projects still collecting information that could support later attempts. Low-cost persistence can therefore matter almost as much as raw intelligence.
What was actually compromised
Reuters independently identified several organizations whose systems appeared in the observed activity. Deere said it took remediation steps and had no indication that sensitive information was accessed. SharkNinja confirmed a breach involving a standalone product-support website and said the threat was contained, while Cummins said it was investigating a possible incident involving a site operated by a third-party vendor. Reuters also contacted smaller affected businesses, and the overall amount of information obtained across the campaign remains uncertain.
NorForge performed its own validation in selected cases rather than accepting every agent claim at face value. The researchers report confirming that an uploader web shell was present on one hardware-parts vendor and validating several additional compromise chains, including activity against an Australian e-commerce site and a very large U.S. retailer. This distinction is essential because an agent saying 'goal met' is not, by itself, proof that a real system was compromised; independent verification is what turns an agent log into stronger evidence.
Why recovery after failure matters
The most consequential aspect of agentic offensive security is not that a model can run a familiar exploit faster than a person. It is that the system can keep searching when the first approach does not work. NorForge's case studies and Reuters' reporting describe agents that explored related infrastructure, accumulated technical facts, tested alternative routes, and sometimes assembled multi-step paths that were not explicitly laid out in the original instruction.
An unexpected result can become a new line of investigation rather than the end of a predefined sequence. The practical question is how reliably agents can make that transition, and whether the surrounding system constrains them to authorized work.
Exposed control panels
The operators left their own control panels exposed while using autonomous systems to compromise other organizations. NorForge says the panels revealed targets, vulnerabilities, and hundreds of secrets. A scan with TruffleHog found that about 11 percent of the discovered credentials could still be verified as valid at the time of testing.
Some dashboards appeared to expose administrative controls that might have allowed an outsider to interfere with ongoing projects, redirect agents, inject information, or restart tasks. NorForge deliberately did not test whether those controls could actually be abused, but the exposure illustrates a deeply human failure mode: advanced AI does not magically compensate for poor operational security. A sophisticated autonomous workflow can still be deployed by people who forget to secure the dashboard controlling it.
A dual-use framework
Cairn's public project presents the framework as a general problem-solving engine, and penetration testing can be a legitimate, authorized security activity. The same capability that helps an attacker search for a weakness can help a defender discover that weakness first. The framework's existence therefore does not establish malicious intent any more than a network scanner, programming language, or web browser becomes criminal because someone uses it in a crime.
As agents improve, this dual-use challenge becomes harder. Vulnerability discovery, code analysis, and autonomous experimentation have clear defensive value, but also appeal to criminals. Access controls, authorization, monitoring, and accountability must accompany those capabilities.
Different failures require different defenses
The Cairn campaign also differs from reported incidents in which evaluation agents crossed their intended boundaries, such as the OpenAI-Hugging Face case. Those incidents raise containment and permissions questions: agents may reach systems outside their authorized scope even when the assigned goal is not malicious.
Here, the operator’s objective was itself malicious. Preventing agents from exceeding legitimate instructions and preventing deliberate abuse are related but distinct problems. Both require controls beyond relying on the model to infer what is allowed.
Defenders are building agent armies too
The same shift is already appearing on the defensive side. NorForge recently tested Cloudflare's open-source security-audit skill, which coordinates many isolated coding agents across reconnaissance, coverage tracking, vulnerability hunting, adversarial verification, and final reporting. In that experiment, dozens of agents divided the work, and findings were checked by fresh agents that had not produced the original claim.
Defenders can use autonomous workers to inspect code, challenge findings, monitor behavior, and help close vulnerabilities. Human judgment remains essential for setting goals and permissions and deciding what evidence is strong enough to act on.
The security problem is moving upward
Cybersecurity has traditionally focused on the vulnerability itself: the exposed service, insecure configuration, weak credential, unsafe deserialization path, or software bug that allows compromise. Agentic systems add a layer above those weaknesses. Security teams must now ask who or what is authorized to search for them, how much autonomy a system receives, which tools it can call, what information it is allowed to retain, and what happens when the agent discovers a path that the designer never anticipated.
NorForge's own product work reflects that change. The company advocates putting agent traffic through controlled egress where requests can be inspected, allowed, blocked, and recorded, rather than trusting an agent simply because its original instruction sounded legitimate. The emerging safety boundary is therefore not only inside the model. It lives in the surrounding architecture: sandboxes, identities, permissions, network policy, audit trails, human approval points, and the ability to stop a system before curiosity becomes unauthorized action.
One hacker, many minds
The title is a metaphor, not a claim that the agents had independent motives. They were software systems pursuing goals chosen by human operators. The operational change is substantial nonetheless: one person can coordinate persistent reasoning processes that share findings, explore alternatives, and keep working across many targets.
The 19 October investigation illustrates how reasoning, memory, tool use, and persistence can be combined into scalable investigative work. Its reported success rates and costs remain estimates, not universal measures of agent capability. But the direction is clear: cybersecurity must address the intent, access, and control surrounding an agent, as well as the intelligence of its model.
Sources and further reading
Reuters — How one hacker used AI agents and a few thousand dollars to break into scores of sites (19 Oct 2026) Read source
NorForge — Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (19 Oct 2026) Read source
Cairn — open-source repository and architecture documentation Read source
The Verge — A hacker broke into John Deere and SharkNinja with an army of AI agents (19 Oct 2026) Read source
NorForge — Field notes: running Cloudflare’s open-source security-audit-skill on a real codebase Read source
NorForge — autonomous-agent containment and egress monitoring Read source
Source note: This article distinguishes reported findings from estimates and interpretation. References to model providers identify components observed in the tooling; they do not imply that those companies directed or approved the attacks.