One hacker broke into more than 100 company websites. He barely lifted a finger. The AI agents did almost everything.

Over the past couple of weeks, a Chinese-speaking hacker compromised websites belonging to more than 100 companies, including farm equipment maker Deere, appliance company SharkNinja and engine manufacturer Cummins, according to an investigation Reuters published on October 19. Each successful break-in cost the attacker about $50 in AI tokens. The human’s role in the whole operation? He wrote fewer than 100 Chinese characters of instructions, then walked away.

“It’s a new world now,” Snorre Fagerland, principal threat researcher at cybersecurity company NorForge, told Reuters. Fagerland, a nearly 30-year cybersecurity veteran, said this is the first real-world proof that commercially available AI agents can carry out complex intrusions from start to finish without human intervention.

How the campaign worked

Fagerland didn’t set out to find this hacker. He was scanning the open web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform that has become popular with hackers. The tool’s web dashboards are often left unprotected — and these were no exception.

Beginning around October 2, Fagerland found about two dozen Cairn instances being used for malicious activity, which let him quietly watch the criminals as they set their AI tools loose. The hacker’s panels showed everything: targets, findings, stolen credentials, live progress. Reuters independently reviewed the activity to confirm the victims’ identities.

The scale was staggering. Starting around September 25, the agents attempted to break into more than 1,200 websites across the United States, Canada, Australia and Japan, according to technology.org’s analysis of the NorForge findings. Of those, more than 100 fell — a roughly 10 percent success rate.

The orders he gave were almost comically brief: find a way to run code on each target site, then plant an uploader web shell for later use. From there, the agents probed on their own, sometimes for roughly 23 hours straight, testing one security weakness after another until something gave.

The tool: Cairn and the agents inside it

Cairn is an open-source platform where you give AI agents a target and a goal, and they work toward it step by step. In this campaign, NorForge traced the activity to worker processes named “claudecode_deepseek-v4.1-flash” — which the researchers read as Anthropic’s Claude Code calling DeepSeek’s low-cost V4.1 Flash model. The campaign combined tools from both US and Chinese AI labs into a single attack pipeline.

Nothing about the targeting was random. Agents went after e-commerce and corporate sites, pre-filtering targets by traffic and testing whether orders could be placed — signs the goal was access that could later be monetized, not just vandalism.

NorForge says this wasn’t even the only crew operating on exposed Cairn dashboards. One similar hacker reportedly stole a database of credit card information. Another tried to force agents to raid a cryptocurrency exchange. The Chinese-speaking operator was simply the most prolific of the bunch.

$50 per breach

Let’s talk money, because the economics are the scary part.

Fagerland estimated the whole campaign burned through about $5,000 worth of AI tokens — roughly $50 per successful hack. That’s a fraction of what a human penetration tester would charge, and the agents worked around the clock without sleep, salary or complaint.

This is the part that should make every CISO’s coffee go cold. One operator, one platform, a few thousand dollars in compute — and over 100 companies ended up with web shells planted in their infrastructure. The defenses that held back script kiddies for years just failed against a machine that kept trying for 23 hours at a stretch.

Why this matters

For years, the industry’s assumption was that AI agents would still need a human looking over their shoulder for serious hacking work. Fagerland held that view himself — and says this campaign changed his mind.

This isn’t a demo. It’s a production run. And it lands at an awkward moment for the AI industry: just last week, OpenAI, Anthropic and Google DeepMind confirmed they’d been quietly coordinating on AI safety for weeks, with cybersecurity as a central focus, according to reports from CoinLive and BitRSS. The same AI labs whose models made this campaign possible are now trying to build shared safeguards against exactly this kind of misuse.

The unresolved question is what was actually taken. Reuters reported it could not establish how much data, if any, the hacker extracted. Deere told the outlet it had taken remediation action and found no indication that sensitive information was accessed. SharkNinja and Cummins are still investigating, according to secondary reports.

The intrusion part, though, is settled. The barrier to running a large-scale hacking campaign has collapsed — and the next operator won’t need to leave their dashboard open to be found.

FAQ

How did AI agents breach 100+ company websites?

According to a Reuters investigation based on a NorForge report, a hacker gave AI agents brief instructions on the open-source Cairn platform and let them autonomously probe more than 1,200 websites. Over 100 were successfully breached, including sites belonging to Deere, SharkNinja and Cummins.

How much did the AI agent hacking campaign cost?

NorForge researcher Snorre Fagerland estimated the campaign spent about $5,000 worth of AI tokens, or roughly $50 per successful breach, with each successful intrusion taking around 23 hours of automated probing.

What is Cairn, the platform behind the AI agent attacks?

Cairn is an open-source AI problem-solving platform that coordinates AI agents to perform tasks with minimal human guidance. The hacker was discovered because several Cairn control panels were left exposed on the open internet.

Did the hackers steal data from the breached companies?

That part is unclear. Reuters reported it could not establish how much data, if any, was extracted. Deere said it had taken remediation actions and found no indication that sensitive information was accessed.

Sources: Reuters; technology.org; AIWeekly; sofx.com