How the Campaign Worked

The Norforge article, published under the title "Inside Cairn," describes an autonomous AI agent that selected its own targets and deployed malicious tools against them. Images included with the post depict target selection screens and a live uploader webshell, suggesting the agent was able to carry out intrusion steps without direct human control at each stage.

The research summary lists 12 primary sources as having been reviewed in connection with the findings, though specific details about the affected companies, the timeline of the intrusions, and the full scope of data compromised were not included in the material available for this report.

Limits of What Is Known

Questions remain about the campaign. The number of affected organizations — described as roughly 100 or more companies — could not be independently confirmed through Korean-language news sources, where a search request hit an access barrier. It is also unclear whether any Korean firms, including major technology companies such as Samsung Electronics, SK hynix, Naver or Kakao, were among the targets.

Security researchers have increasingly warned that AI agents capable of autonomous decision-making could lower the barrier to large-scale cyber intrusions, but concrete, documented cases remain rare. The Norforge report, if its findings hold up to further scrutiny, would represent one of the most extensive examples to date.

The claim that an AI agent breached 100-plus companies is, based on the documented evidence, mostly true.