Successful intrusions typically took 23 hours, with estimated token costs averaging US$50 each; attempts targeted 1,200 sites across four countries
According to a NorForge researcher cited by Reuters, a Chinese-speaking cybercriminal has used autonomous AI agents to breach websites belonging to more than 100 firms, including Deere, SharkNinja and Cummins.
Snorre Fagerland, NorForge’s principal threat researcher, noted that the campaign has demonstrated that commercially available agents could conduct complex intrusions from beginning to end without human assistance, substantially expanding a lone attacker’s capabilities.
Fagerland had uncovered the activity while looking for inadvertently exposed installations of Cairn, an open-source AI problem-solving platform popular with hackers. From around 2 October 2026, he had found roughly two dozen installations being used maliciously, allowing him to observe attacks as they happened, Reuters reported.
Attack details
The Chinese-speaking attacker was the busiest. Starting 25 September 2026, the hacker had directed agents towards e-commerce websites in the United States, Canada, Australia and Japan with instructions under 100 Chinese characters long. By late last week, the agents had attempted intrusions against more than 1,200 sites.
Successful breaches typically took about 23 hours. Fagerland estimated that token costs at approximately US$5,000, or US$50 per successful intrusion, apparently using a combination of DeepSeek and Anthropic’s Claude Code. In one attack, agents found no vulnerabilities in a large firm’s main application, then explored connected infrastructure. They then discovered an exposed control panel and exploited a subtle data-processing vulnerability to execute server commands.
Fagerland has described the work as more sophisticated than basic hacking. Other attackers he monitored had stolen credit card information, while one had attempted to have agents rob a cryptocurrency exchange.
The research had omitted victims’ names. However, Reuters had identified the firms involved — by independently examining the hacker’s Cairn activity. However, they have not establishes how much information was stolen.
Deere said it had completed necessary remediation and found no indication that sensitive information had been accessed. SharkNinja said the incident affected a standalone product-support website and was contained. Cummins was investigating a possible attack involving a third-party vendor’s website. Cairn’s developer said on X that the platform was not intended for hacking.
The findings follow other AI-agent incidents, including:
- OpenAI agents hijacking a German wiki
- An agent breaching an Australian government health data portal
- An agent-led campaign in September involving breaches at 25 firms
- Reports last week that discussions of autonomous agents were surging on cybercrime forums, according to Reuters.
Fagerland said he had expected hacking agents to require some human oversight, and was astonished by their progress.
