Cairn agent framework; underlying model varies/undisclosed: Deere, SharkNinja, Cummins and other websites
Review CAT-X10 · Catalogue X10, RAT-078
EXCLUDED — human-directed attack campaign. Human hacker set offensive goals and targets. Contemporary news near-match excluded under user’s no-human-hacks rule.
Reviewed: Not recorded · Rule: external-intrusion-v1
NorForge’s original describes threat actors selecting targets and objectives in exposed Cairn panels, including explicit webshell goals and operator hints. Tactical autonomy carries out human attack intent. The existing catalogue X10 already excludes this campaign family.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Evidence status
EXCLUDED — human-directed attack campaign
Dates and discovery
- Incident date
- Late Sep–Oct 2026; target-specific dates not provided
- Catalogue disclosure / source date
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- Not recorded
- Discovery channel
- Not recorded
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Reuters / Raphael Satter — How one hacker used AI agents to break into scores of sites (Oct 19, 2026)Reporting / interview · www.investing.com
- Reddit discovery / discussionReddit discovery / discussion · www.reddit.com
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- norforge.comOriginal account · norforge.com
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source - · Case-by-case comparison audit
RAT-078: out-of-scope. NorForge’s original describes threat actors selecting targets and objectives in exposed Cairn panels, including explicit webshell goals and operator hints. Tactical autonomy carries out human attack intent. The existing catalogue X10 already excludes this campaign family. Source checks: read: https://norforge.com/blog/inside_cairn. NorForge’s original describes threat actors selecting targets and objectives in exposed Cairn panels, including explicit webshell goals and operator hints. Tactical autonomy carries out human attack intent. The existing catalogue X10 already excludes this campaign family.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.