Digital illustration of autonomous AI agents probing a grid of company website targets

One Hacker’s AI Agents Breached 100+ Company Sites for About $50 Each

ByChris Wade

Key takeaway: A cybersecurity report published October 19, 2026 found that one hacker aimed autonomous AI agents at more than 1,200 company websites and breached over 100 — including Deere, SharkNinja and Cummins — at an estimated cost of about $50 per hack. The agents worked for roughly 23 hours each with almost no human help.

A hacker barely lifted a finger while AI agents did the break-ins. That is the headline from a new report by Snorre Fagerland, principal threat researcher at the cybersecurity company NorForge, shared with Reuters on October 19. A Chinese-speaking operator pointed AI agents at company websites across four countries, and the agents spent hours autonomously probing and breaking in — the clearest evidence yet that AI agents can run a full hacking campaign end to end.

What happened: the NorForge report

Fagerland was not looking for this hacker. He was scanning the open internet for exposed instances of Cairn, an open-source AI agent platform that gives agents a starting point and a goal and lets them work step by step, documenting progress on a shared board. Built for authorized penetration testing, Cairn has become popular with hackers, and its operators often leave its web interface unprotected. Beginning around October 2, Fagerland found about two dozen Cairn instances in malicious use — open dashboards that let him quietly watch the operators at work.

One operator stood out. From around September 25, the Chinese-speaking hacker directed agents at more than 1,200 websites — mostly e-commerce servers in the United States, Canada, Australia and Japan — reaching websites belonging to more than 100 companies. Reuters independently reviewed the hacker’s Cairn activity and identified three victims: Deere (John Deere), SharkNinja, and Cummins.

The hacker did almost none of the work. The operator issued instructions in fewer than 100 Chinese characters, and the agents then audited target infrastructure for hours, adjusting tactics after failed attempts. Their playbook: find a way to run code on the site, then plant an uploader web shell for persistent access. Cairn’s author, who posts as “le1xia0”, told Reuters the tool was not designed for attacks and that harmful use was not their intention.

The knowns and the unknowns

What is confirmed:

  • More than 1,200 sites were targeted; over 100 company websites were breached.
  • Each successful breach took the agents about 23 hours of autonomous work.
  • The campaign cost roughly $5,000 in AI tokens — about $50 per successful hack.
  • Deere took “necessary remediation actions” with no indication sensitive information was accessed. SharkNinja said a standalone support-information site was hit and the threat was contained.

What is still unknown:

  • Reuters could not determine how much data, if any, was actually extracted. Access is not the same as theft.
  • The hacker’s identity and whether they acted alone.
  • Whether the web shells planted on breached sites were removed everywhere — residual backdoors are a standard post-breach risk.

Why this matters: AI agents as a force multiplier

“It’s a new world now,” Fagerland told Reuters. The significance is the cost math: one person with roughly $5,000 in AI tokens ran a campaign at a scale that used to require a skilled team. The economics of hacking just shifted — and not in defenders’ favor.

The same autonomous capabilities that power business automation — see our guide to AI agents for business automation — can be pointed at someone else’s infrastructure. The defensive lesson: every exposed login, unpatched plugin and open dashboard is now a standing invitation to software that never sleeps.

What to watch: whether any breached company reports data theft in the coming weeks; whether agent-platform providers add authentication-by-default after this exposure; whether regulators move on autonomous agents, alongside efforts like NVIDIA’s $250M commitment to UK AI safety research; and whether copycats emerge — Fagerland found about two dozen malicious Cairn instances, so this hacker was one of several.

Analysis: Defenders cannot un-invent this. The playbook — cheap, autonomous, relentless — will be reused. The practical defense is boring but effective: patch internet-facing software, require authentication on every admin panel, and assume exposed services are already on someone’s target list.

Frequently asked questions

How did one hacker breach over 100 websites with AI agents?

The hacker used Cairn, an open-source AI agent platform, with instructions of fewer than 100 Chinese characters. The agents then spent hours autonomously probing more than 1,200 websites across four countries, breaching over 100 company sites by finding code-execution flaws and planting web shells, per the NorForge report shared with Reuters.

What is Cairn, the tool behind the attacks?

Cairn is an open-source AI platform that lets operators give AI agents a goal, after which the agents work step by step and document progress on a shared board. Built for authorized penetration testing, it has become popular with hackers. Its author told Reuters malicious use was not its intended purpose.

How much did the AI-powered hacking campaign cost?

NorForge estimated the campaign cost about $5,000 in AI tokens — roughly $50 per successful hack — with each intrusion taking the agents about 23 hours of autonomous work.

Did the hacker steal sensitive data from the companies?

That remains unknown. Reuters could not determine whether the breaches led to data extraction. John Deere said it had no indication sensitive information was accessed, and SharkNinja said only a standalone product-support site was affected.

How can businesses defend against autonomous AI attacks?

Keep internet-facing software patched, put authentication on every admin interface, and remove exposed control panels from the public internet. AI agents can probe targets around the clock at low cost, so even low-priority exposed services need the same security hygiene as critical systems.

Sources


Similar Posts