AI Industry

One Hacker Used AI Agents to Breach 100+ Company Websites

Oct 20, 2026·7 min read·By Rahish Saifi

Hooded figure seen from behind working at laptops on a desk in front of a window with night city lights in a dark room

Over a couple of weeks, a cybersecurity researcher watched a Chinese-speaking hacker break into websites belonging to more than 100 companies—including farm equipment maker Deere, home appliance company SharkNinja, and engine maker Cummins—by outsourcing the work almost entirely to AI agents, according to a Reuters exclusive published October 19, 2026 (Raphael Satter) and a same-day NorForge report by principal threat researcher Snorre Fagerland. The story is one of the clearest public cases yet of autonomous agents used at scale for financially motivated intrusions—not a red-team exercise gone wrong, but a solo operator steering bots through an open-source platform called Cairn.

Key facts

Item	Detail
Who	Chinese-speaking operator (identity not named in reporting); observed by NorForge's Snorre Fagerland
Scale (Reuters)	Successful breaches at 100+ companies; agents had attempted more than 1,200 sites as of late last week
Named victims (Reuters)	Deere, SharkNinja, Cummins; two smaller businesses also acknowledged compromise
Platform	Cairn, open-source multi-agent problem-solving software; exposed admin panels let outsiders watch projects in real time
Models (reported)	Campaign appeared to use a mix of China's DeepSeek and Anthropic's Claude Code, per Reuters; NorForge says the worker name could mean a Claude Code harness using DeepSeek 4.1 Flash
Timing	Activity began Sept. 25, 2026; Fagerland tracked Cairn instances from around Oct. 2
Primary sources	NorForge: Inside Cairn (Oct. 19); Reuters syndicated by NDTV, CTV and others

What happened

Fagerland told Reuters he found the operator while scanning the web for inadvertently exposed instances of Cairn, which Reuters describes as an open-source AI problem-solving platform popular with hackers; NorForge notes legitimate red teams use it too. From around October 2, he identified about two dozen Cairn instances used for malicious activity, according to Reuters. NorForge's own write-up puts the count at more than 20 exposed panels tied to likely malicious use, all appearing financially motivated with no obvious state-sponsored activity.

NorForge did not name victims in its report. Reuters said it identified Deere, SharkNinja, Cummins and others by independently reviewing the hacker's Cairn activity. Reuters could not ascertain to what degree data was extracted from compromised sites.

Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Those statements reflect corporate responses at the time of reporting, not a final forensic conclusion.

The operator began on September 25, targeting e-commerce sites in the United States, Canada, Australia, and Japan, with task instructions of fewer than 100 Chinese characters, Reuters reported. Fagerland told Reuters the campaign used roughly $5,000 of model tokens—about $50 per successful hack.

How the AI agents worked

Cairn is described in NorForge's report as a state-based problem-solving engine: each job is a project with an origin and a goal. Agents post "facts" and "intents" to a shared blackboard that human operators can steer with hints. That architecture is meant for open-ended research and automation; defenders say exposed deployments turned it into a live window on crime.

NorForge grouped the Chinese-language activity as cluster AIA0001: 14 panels, more than 1,100 attack projects, mostly aimed at the US, Japan, and Australia, with high confidence it was malicious. Targets were pre-ranked by web traffic (roughly 200,000 to 1.5 million visitors, per the attacker's own task text, as quoted by NorForge) and pre-checked with browser automation. Tasks ran under a worker name claudecode_deepseek-v4.1-flash; NorForge says the worker name could mean a Claude Code harness using DeepSeek 4.1 Flash.

Across harnesses NorForge studied, average success rates hovered around 10%. For AIA0001, successful projects took a little under 23 hours from start to goal on average—matching Reuters' figure that successful intrusions typically took around 23 hours—with about 140 facts posted per project; one project ran more than five days. Reuters said agents spent hours autonomously probing and breaking into sites, and that the hacker did almost none of the work.

Fagerland told Reuters: "It's a new world now." He added: "It's not straightforward to come up with solutions like that. It's not script kiddie stuff." And: "The development in this field is astounding." Cairn's author, posting as le1xia0 on X, said the platform was "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention."

What it cost

Two cost pictures appear in the sources, and they measure different things. In Reuters, Fagerland estimated the Chinese-speaking operator's campaign used about $5,000 of tokens total—roughly $50 per successful hack at the scale Reuters described. That figure bundles model spend against confirmed wins, not every failed probe.

NorForge's report offers a per-task view: for cluster AIA0001 it estimated an average cost per task around $5, including failed projects, with long projects possibly over $100, and stresses that uncertainty is considerable. A ~$5 average per attempt and a ~$50 figure per successful breach can coexist when most attempts fail and only about one in ten succeed.

Either way, the economics matter: a single actor with a few thousand dollars of API credit and short natural-language orders can aim at four-figure site counts. That is a different threat model from traditional botnets that required more hands-on exploit development.

The attackers' own mistake

The same openness that made Cairn easy to adopt made the campaign visible. Exposed panels leaked operational detail: NorForge says they appeared to offer full admin controls and exposed hundreds of secrets; 11% of those were verified valid by the Trufflehog scanner. Many legitimate red-team Cairn deployments were exposed the same way, potentially putting their clients at risk, NorForge warned.

NorForge says it cooperated with Reuters to notify victims and is trying to get panels taken down. Fagerland's monitoring also surfaced other Cairn users: Reuters reported one stole a trove of credit card data and another tried to get AI agents to rob a cryptocurrency exchange. NorForge labels a separate English-language cluster (AIA0002) focused on card and crypto theft.

Why it matters for businesses

Analysis. The Reuters and NorForge accounts describe cheap scale for one attacker: short instructions, long autonomous runs, and a hit rate that still produced triple-digit compromises. Retail and B2B e-commerce storefronts and payment-adjacent infrastructure were the apparent prize for AIA0001, not obscure corporate intranets.

Several named victims highlight third-party and standalone sites—support portals, vendor-operated properties—not always the same systems that hold core ERP data. That matches a pattern security teams already know from supply-chain breaches: the weakest public-facing site can still harm brand, support operations, and customer trust even when "sensitive" back-office data stays untouched.

Context from Reuters points to a widening lane of AI-assisted crime. In August, Israeli firm Gambit Security found Russian-speaking extortionists used an AI tool to break into seven organizations; in September Gambit documented an AI agent-driven spree with breaches at 25 companies and theft of at least 600,000 credit card records. Bitsight said discussion of autonomous agents was surging on cybercriminal forums. This Cairn case adds a public view of agent orchestration—not just a model answering phishing emails.

Policy threads overlap: US agencies are moving to restrict some Chinese AI vendors on government systems, as in the recent DeepSeek exclusion order for federal civilian agencies. This incident is different—alleged criminal misuse of commercial and open models—but it feeds the same debate about where agent tooling outpaces guardrails.

What defenders should do now

Reporting stays high level; the goal is resilience, not replication.

Patch and harden storefront platforms—e-commerce CMS plugins, payment modules, and forgotten staging hosts are common agent targets when traffic ranking drives victim selection.
Monitor for unexpected upload surfaces and webshells on public sites; autonomous agents can iterate for hours—detection should assume slow, noisy probing.
Rotate credentials if any admin, API, or CI secret might have lived on a compromised or exposed host; NorForge's secret leak statistics underline how often operators reuse keys.
Inventory vendor-hosted sites that carry your brand (support, campaigns, regional shops) and apply the same logging and WAF rules as primary domains.
Rate-limit, log, and alert on authentication and admin paths; agent swarms generate distinctive traffic even when they mimic browsers.
Review agent frameworks you deploy internally; exposed multi-agent panels are a risk for red teams too. Research on weak tool boundaries in agent stacks—such as the Repeat-After-Me bypass against six agent frameworks—shows how execution context must be locked down even for legitimate automation.

What to watch next

Watch whether Cairn maintainers and hosts succeed in takedowns of malicious panels and whether more victims confirm data access beyond website defacement. NorForge and Reuters-driven notifications may trigger further corporate statements and regulatory interest in agent abuse.

AI lab responses—from Anthropic on Claude Code harness misuse and from DeepSeek on model use in intrusion workflows—could shape terms of service, abuse monitoring, and enterprise sales. Legislators may also ask whether open agent frameworks need stronger default authentication, even as vendors argue dual-use research benefits.

For security leaders, the operational question is whether detection stacks trained on human-speed attacks can keep pace with agents that post a hundred facts per project and run for days. Fagerland's verdict—that this is not "script kiddie stuff"—is a signal to treat agent-driven intrusion as a standing category, not a one-off stunt.