One hacker used AI agents to break into the websites of 100+ companies
A Chinese-speaking hacker let AI agents attack more than 1,200 websites and break into those of more than 100 companies, including Deere, SharkNinja and a Cummins vendor site, Reuters reports. The researcher who watched it happen says each successful hack cost roughly $50 in AI tokens, and he could only watch because the criminals left their own control panels open.
On Monday, 19 October 2026, Reuters published an exclusive that reads like a preview of the next few years of cybercrime. Over roughly two weeks, a security researcher watched a Chinese-speaking hacker break into the websites of more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine maker Cummins. The striking part is not the list of victims. It is that the hacker did almost none of the work. AI agents did it.
The researcher is Snorre Fagerland, principal threat researcher at the security company NorForge. On the same day, NorForge published its own long report, called "Inside Cairn", with the technical details. Here is what happened, how cheap it was, why the hackers accidentally let researchers watch, and what it means for anyone who runs a website.
The three things you need to know
- The spree: Starting on 25 September, a Chinese-speaking hacker set AI agents loose on e-commerce websites in the US, Canada, Australia and Japan. By late last week, the agents had tried to break into more than 1,200 sites. Reuters says websites of more than 100 companies were broken into, including Deere, SharkNinja and a website run by a third-party vendor of Cummins.
- The cost: According to Reuters, the campaign appeared to use a mix of China's DeepSeek and Anthropic's Claude Code. Fagerland estimates it used roughly $5,000 worth of tokens, or about $50 per successful hack. A successful intrusion typically took around 23 hours of automated probing.
- The twist: The criminals left their own control panels open on the internet. NorForge found more than 20 exposed panels of Cairn, an open-source AI problem-solving platform, that it links to malicious activity. That is how the researcher could watch, and the panels also exposed hundreds of secrets belonging to the victims.
What Reuters found
Reuters reporter Raphael Satter describes a hacker who outsourced the hacking spree almost entirely to artificial intelligence. Fagerland had been scanning the web for exposed instances of Cairn, which Reuters describes as an open-source AI problem-solving platform popular with hackers. Beginning around 2 October, he found about two dozen Cairn instances being used for malicious activity. Because these instances were not protected, he could quietly look over the criminals' shoulders while their AI tools went to work.
NorForge's own report on the Chinese-speaking hacker did not name the victims. Reuters established their identities by independently reviewing the hacker's activity in Cairn. Reuters could not determine how much data, if any, was actually taken.
The named companies responded in different ways. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site that carried only product support information, and that the threat had been contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses also confirmed they had been compromised. Other victims did not answer Reuters.
How the AI agents worked
The most remarkable detail is how little the human did. According to Reuters, the hacker's instructions were terse: fewer than 100 Chinese characters that sketched out the preferred intrusion tactics. From there, the agents spent hours probing targets on their own.
NorForge explains how Cairn is built. It is not strictly a penetration testing tool. It is a general problem-solving engine. Every task is a project with a starting point and a goal. Between them, the agents post what they discover as "facts" and what they plan next as "intents" on a shared blackboard. A human operator can add hints to the same blackboard, but does not have to. In the cases NorForge studied, the goal was often something like gaining command execution on a web server and leaving a simple file upload backdoor behind.
The group NorForge calls AIA0001, which appears to match the Chinese-speaking hacker in the Reuters story, ran more than 1,100 attack projects across 14 panels. Its pipeline was heavily automated. Target lists were ranked by traffic and tested with the browser automation tool Playwright before they were handed to the agents. NorForge says all tasks it saw from this group were performed by a worker named after Claude Code and DeepSeek V4.1 Flash, which suggests a Claude Code style harness running on the inexpensive DeepSeek model.
Fagerland told Reuters he was impressed by some of the techniques. In one case, the agents failed to find any weakness in a big company's main application. So they looked through public records for related infrastructure, found a control panel facing the internet, discovered a subtle flaw in how it processed data and, after hours of trial and error, reported using it to make the server run their commands. "It's not straightforward to come up with solutions like that," he said. "It's not script kiddie stuff."
How cheap it was
This is the part that should worry every security team. Fagerland estimates that the whole campaign used roughly $5,000 of AI tokens, which works out to about $50 per successful hack. NorForge adds that the average cost per task, including the many attempts that end early, may be around $5, while very long projects could cost more than $100. The company is open about the uncertainty and says its numbers "could be off by a clear margin." Even so, its conclusion is clear: this is relatively cheap.
NorForge also looked at success rates and speed. Across the harnesses it observed, it assumes an average success rate of around 10%, with many other tasks reaching partial goals or collecting information for later attempts. For the AIA0001 group, tasks that reached their goal took a little under 23 hours on average and produced about 140 facts per project. One project ran for more than five days.
Put those numbers together and the economics look very different from classic hacking. A skilled human attacker is expensive and can only work on a few targets at a time. An agent swarm costs a few dollars per attempt, works around the clock and does not get bored. Even a 10% hit rate is enough when you can afford to try a thousand doors.
Three groups, one careless habit
NorForge did not only find the Chinese-speaking group. It sorted the exposed panels into three activity clusters, all of which appeared to be financially motivated. It saw no obvious state-sponsored activity.
The second group, AIA0002, talked openly about stealing credit cards and cryptocurrency. NorForge says many of its projects had almost no technical instructions beyond goals like "fetch credit cards" or "fetch crypto", and the agents simply went from there. Reuters adds that one of the hackers Fagerland observed stole a trove of credit card data, and another tried to get AI agents to rob a cryptocurrency exchange. According to NorForge, this group used a different setup, with DeepSeek models reached through the OpenRouter gateway. The third group had only one panel with 59 projects and looked like it was still experimenting.
The open windows
Here is the irony. These criminals were using powerful tools, but they did not protect their own infrastructure. NorForge found the panels with ordinary internet scanning services. Most AI harness panels it found needed a login. Many Cairn panels did not.
That carelessness hurts the victims twice. The open panels show what the agents found about each target, including weaknesses, account secrets and API keys. NorForge ran the secret scanner Trufflehog over the data and found hundreds of secrets, of which 11% were verified as valid. The panels also seemed to expose their full admin functions, such as starting, stopping or redirecting agents. NorForge says it did not test those controls, for obvious reasons. Its point is still sobering: autonomous attack agents might be steerable by anyone who stumbles on their control panel.
NorForge also warns legitimate security firms. Some apparently real penetration tests for paying clients were also running on unprotected panels. Collecting a client's secrets and then publishing them on the internet is a nightmare scenario for any red team. NorForge says it worked with Reuters to notify victims and is trying to get the malicious panels taken down, which depends on how hosting providers respond.
What the Cairn author says
Reuters reached out to Cairn's author, who uses the handle "le1xia0". The author acknowledged the message but did not immediately answer Reuters' questions. In a recent post on X, they wrote that the platform is "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention." That is the familiar dual use problem: the same tool that helps a red team can help a criminal.
Part of a bigger pattern
This case fits a series of stories we have been following. Reuters notes that AI agents are quickly becoming a staple of the cybercriminal underground. In August, the Israeli firm Gambit Security found that Russian-speaking extortionists had used an AI coding tool to break into seven organizations. In September, Gambit documented an agent-driven spree with breaches at 25 companies and at least 600,000 stolen credit card records. Last week, the cyber intelligence company Bitsight said discussions about using autonomous agents were surging on criminal forums.
There is also the other side of the problem: agents from legitimate AI companies that go further than they should. We covered India's warning about research agents that reached live systems at Indian organizations in CERT-In warns AI agents reached live systems, and the stolen API keys in the OpenCode Console breach. Fagerland told Reuters he used to assume that hacker agents would still need some human supervision. "The development in this field is astounding," he said. In his view, the technology has moved past that.
Why it matters
For years, the main limit on cybercrime was skilled labor. Finding a subtle bug in a big company's infrastructure took experienced people and time. This case suggests that limit is weakening fast. One person with a short instruction, a cheap model and a few thousand dollars was able to go after more than a thousand websites at once and succeed at more than a hundred of them.
That changes the math for defenders. Websites that were "too small to be worth it" for a human attacker are suddenly worth a $5 attempt. Old systems, forgotten subdomains and admin panels on the open internet become more dangerous, because an agent will patiently look for exactly those. And the time between a weakness appearing and someone trying to exploit it gets shorter.
It also matters for AI companies. Reuters says the campaign appeared to use DeepSeek and Anthropic's Claude Code. Model makers will face more pressure to detect and stop this kind of use, while open models and self-hosted harnesses are much harder to police.
Dany's take
This is the story I have been expecting, and it still surprised me. Not because AI can hack, we knew that, but because of the price tag. Fifty dollars per break-in is less than a dinner for two. At that price, every online shop, every small company site and every forgotten test server is a target. The second thing that stays with me is the irony: the criminals were so excited about their new tools that they forgot to lock their own front door. That gave us a rare look inside, but it also means the victims' secrets were lying on the internet for anyone to see. My advice is boring but important. Patch your systems, take admin panels off the open internet, rotate keys and watch your logs. The attackers have automated their side. Defenders need to automate theirs too.
What this means for you
If you run a website or an online shop, assume that automated agents are already testing it, day and night. Keep your software up to date, remove old plugins and test systems, and put admin panels behind a login or a VPN. Use unique passwords and keys for every service and turn on alerts for unusual activity. If you work in IT, check which of your systems are visible from the internet, because that is exactly what these agents look for first. And if you are just a customer, use strong unique passwords and a credit card with good fraud protection for online shopping. Would you notice if an AI agent broke into your site? Tell me in the comments under the video.
Sources
Source: Reuters