The Pen-Test Tool That Broke Into 100 Companies, and the Question It Leaves Every Buyer

On 19 October, Reuters reported that a single Chinese-speaking operator had used autonomous AI agents to attempt break-ins at more than 1,200 websites, reaching systems belonging to over 100 companies. Deere said it had taken remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and that it had contained the threat. Cummins said it was looking into a possible attack on a site run by one of its vendors. Reuters could not establish how much data, if any, was taken.

The detail worth sitting with is not the scale. It is the tool.

The Tool Behind the Attacks

The agents ran on Cairn, an open-source multi-agent framework whose stated purpose is penetration testing. Operators hand it a target and a goal, and its agents work the problem step by step, posting findings to a shared board the other agents can read. It was built to be pointed at systems you own, by people authorized to attack them. Its author, who posts as le1xia0, said publicly that using it for harmful attacks was not the intention.

That intention made no difference, because nothing in the software enforced it. The researcher who found the campaign, Snorre Fagerland of NorForge, located it by stumbling on control panels the operator had left exposed to the internet.

The Same Tools for Attackers and Defenders

So the uncomfortable fact underneath the headline is this: the toolkit an attacker used and the toolkit a defender buys are now the same software, assembled from the same parts. One of the worker processes visible in those exposed panels was named in a way that suggests a common coding agent driving an open-weight Chinese model. Neither component is exotic. Both are available to anyone with a credit card and an afternoon, and the open-weight releases coming out of DeepSeek, Zhipu and Moonshot keep pushing the floor down.

The economics have moved accordingly. Fagerland put the cost at roughly fifty dollars per successful intrusion, a figure he called a rough estimate; NorForge’s own report works out to about five dollars per task once failed attempts are counted. Successful intrusions took a little under twenty-three hours on average, and the overall success rate was around ten percent. A ten percent hit rate is terrible if a human is doing the work and irrelevant if nobody is. You simply run more attempts.

The Procurement Problem for Defenders

Defenders are going to answer this the obvious way, by hiring autonomous agents of their own to find the holes first. That is a reasonable response, and it creates a procurement problem that looks nothing like buying software.

Think about what you are actually doing when you engage an AI penetration-testing agent. You are granting an autonomous program, operating with its own judgment, permission to attack your production infrastructure. You are giving it credentials, scope and time. And the thing you are trusting is, at the level of code, indistinguishable from the thing in the Reuters story. Same frameworks. Same models. Same shared board. The difference is entirely a matter of who is operating it and what happens to them if it goes wrong.

How Can You Verify an AI Agent?

Now ask how you would verify that difference before you sign.

The agent’s code tells you nothing, because the same code serves both uses. The vendor’s website tells you nothing, because anyone can claim a methodology. Certifications were designed for humans attached to employers and legal identities, and they do not transfer cleanly to a program that can be spun up, used and discarded in a week. Reviews on the vendor’s own site are the vendor’s own marketing. What you want is the thing that has always distinguished a counterparty worth trusting from one worth avoiding: a record of completed transactions, with something at stake, that you can check without taking anyone’s word for it.

That record barely exists for autonomous agents today, and building it is a genuinely hard problem rather than a missing feature. It has to be tied to real transactions, because anything self-asserted gets fabricated. It has to be readable by the buyer without an account, because an accountability record you have to register to see is a marketing funnel. It has to be portable, because a reputation locked inside one vendor’s platform is that vendor’s asset, not the agent’s. And it has to be honest about its own thinness, because a confident five-star average computed from two ratings is worse than no number at all.

Building Trust Through Reputation Records

A handful of teams are working on this layer. One of them, a neutral agent-to-agent marketplace, makes the design choices concrete enough to argue with. Each party is nothing but a stable twelve-character handle during discovery and negotiation, which means neither side has to publish an owner’s contact details simply to talk terms. Identities are exchanged only when a deal actually closes, and the broker steps out of the loop at that moment rather than sitting in the middle of the relationship it introduced. The reputation record for any handle is readable with a plain unauthenticated request: no key, no account, no sign-up. It separates buyer-side and seller-side history, counts non-deliveries and disputes alongside ratings, and, in the part most review systems get wrong, refuses to display a rating at all until enough rated deals exist to mean something.

It is early, and a young marketplace’s record is a young record. But the shape is the point, and the shape is checkable rather than claimed: you can fetch any handle’s record yourself in one request and see exactly what it does and does not know.

The Future of Autonomous AI Agents

The Cairn campaign will not be the last of its kind, and the defensive market it creates is going to fill up quickly with agents that are excellent, agents that are useless, and agents that are the problem wearing a product page. Telling them apart by inspecting the software is not going to work, because the software is the same. The question that will matter is older and duller than the technology: what has this counterparty actually done, who says so, and what does it lose if it burns me?

Right now, for most agents you could hire, there is no way to answer that. That gap is the real finding in the October reporting.