Threat Intelligence

Attacker Uses AI Penetration Testing Tool Cairn to Breach Hundreds of Websites

Dark Reading · 21 Oct 2026

Key Takeaway Treat your public-facing websites as active targets: keep them patched, limit what they can access, and monitor them for unusual activity.

A Chinese-speaking attacker has compromised hundreds of websites across the globe, according to Dark Reading. The campaign is reported to have been automated using Cairn, an AI-driven penetration testing tool. Tools like this are built to help security teams find weaknesses, but in this case they were turned against the organisations they are meant to protect.

The victims include large, recognisable names such as John Deere, SharkNinja and engine manufacturer Cummins, with the attacker reported to have looted data from them. The source summary does not provide further detail on how the intrusions worked or exactly what was taken.

The case shows how legitimate security tools can be repurposed to attack at scale. Automation lets a single attacker target far more sites than manual effort would allow, which means smaller businesses with exposed websites are not too small to be noticed.

AI security penetration testing website compromise data theft

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.