This week ·
John Deere
How they got in, as reported. Automated AI tools that work through many organizations at once.
← All items this week- Date
- 20 Oct 2026
- Place
- China
- Who
- John Deere · Manufacturing / Wholesale Suppliers
- The way in
- Automated attacks run by AI agents
- Source
- SecurityWeek
01 · What was reported
What was reported.
Threat actors abused the open source AI platform Cairn to automate attacks and gain persistent access to over 100 companies, including John Deere. The campaign leveraged AI agents to target e-commerce and payment infrastructure to...
The way in, as the source states it: automated AI tools that work through many organizations at once.
02 · What we check for it
What we check for it.
The doors those tools look for first, read from outside.
03 · If this happens at your firm
If this happens at your firm.
- Turn automatic updates on for every computer, phone, website and server.What changes: updates install by themselves, now and then with a restart. It stays on. Choose the hour they run in the update settings, and pause one there if it breaks something.
- Leave nothing that runs your systems reachable from the internet: admin pages, remote desktop and file shares sit behind a private connection or are switched off.What changes: staff connect through the private connection before they reach those pages. It stays on. A page can be opened to one address when it is needed, and closed again the same way.
- Turn on a second sign-in step for every account, email first.What changes: a code or a tap on the phone at each new sign-in. It stays on. A backup code or a second device covers a lost phone, and the method is changed in the account's security settings.
04 · Source
Source.
Source: SecurityWeek ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.