A hacker used AI agents and a few thousand dollars to hack dozens of websites
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
A single Chinese-speaking attacker turned AI agents loose on more than 1,200 websites; they breached those of more than 100 companies, among them Deere, SharkNinja and Cummins. Snorre Fagerland of NorForge spotted it after finding exposed Cairn installations. By his estimate, the operation spent roughly $5,000 on tokens, with DeepSeek and Claude Code as the apparent engines.
A Chinese-speaking hacker has used AI agents to try to get into more than 1,200 websites and managed to break into sites of more than 100 companies over the past two weeks, according to a Reuters exclusive.
The campaign was uncovered by Snorre Fagerland, NorForge's principal threat researcher, while he searched the internet for Cairn installations left exposed by mistake. Cairn is an open-source AI platform for solving problems that is widely used by hackers. From around October 2, Fagerland spotted about two dozen installations put to malicious use, which let him watch the attackers at work. His report, published this Monday and shared with Reuters in advance, does not name the victims; the news agency identified them on its own by going through the hacker's activity on Cairn.
The attacker started on September 25 and went after online stores in Japan, the United States, Canada and Australia. The instructions given to the agents took up fewer than 100 Chinese characters and barely outlined the tactics the hacker favored. Fagerland estimates the campaign burned through roughly $5,000 in tokens, about $50 for each successful break-in, and each success usually needed around 23 hours of probing for weak spots. The agents seemed to combine DeepSeek and Claude Code, Anthropic's coding assistant.
In one case, after finding no weak points in a large company's public application, the agents dug through digital records to reach related infrastructure, found an exposed control panel, spotted a subtle flaw in how it handled data and, after many hours of trial and error, said they had used it to make the server run malicious commands. "It's not straightforward to come up with solutions like that," said Fagerland, who has spent nearly 30 years in cybersecurity.
Reuters has identified Deere, SharkNinja and Cummins among the victims. Deere says it took the "necessary remediation actions" and has "no indication that sensitive information was accessed." SharkNinja explains that the attack reached a separate site holding only support information for its products and that the threat is contained. Cummins says it is looking into a possible cyberattack against a website run by one of its outside suppliers. Two smaller companies have also admitted the intrusion; the other companies that appear in Cairn's records did not respond.
Reuters has not been able to confirm whether the attackers took any data or how much. Fagerland also saw other attackers using Cairn: one stole a large batch of credit card data and another tried to get the agents to raid a cryptocurrency exchange. Cairn's author, who goes by "le1xia0" online, did not immediately answer the agency's questions; in a recent post on X, they wrote that the platform was not designed for cyberattacks and that, if it is used for harmful ones, "that is not my intention."
The case follows similar ones: in August, Israeli firm Gambit Security found Russian-speaking extortionists who had used the AI tool Cursor to break into seven organizations, and in September it documented another agent-driven wave that hit 25 companies and took at least 600,000 card records. Fagerland admits he thought these agents would need at least some human supervision and says it is now clear the technology has moved beyond that.
Why it matters · analysis and opinion
What changes with this case is the scale a single person can reach: a few instructions and a modest budget are enough for machines to hunt for flaws tirelessly for hours. The victims were not only main websites but also secondary sites, exposed panels and pages run by suppliers, exactly what gets watched least. For any company with an online presence, the immediate task is to take stock of everything it has published, including forgotten subdomains and what third parties maintain, close administration panels to public access and check logs for long, repeated probing. How much data left is still unknown, and that gap is another warning: without good logs, that question cannot even be answered.
Source: Reuters (Devdiscourse) · Written with the help of AI: how we make the news
