Hacker Used AI Agents to Breach 100+ Company Websites, Report Says

A Chinese-speaking hacker used a swarm of AI agents to break into websites belonging to more than 100 companies, including farm equipment maker Deere, Needham, Massachusetts-based appliance company SharkNinja and engine maker Cummins, Reuters reported on Monday, Oct. 19, 2026. The findings come from security firm NorForge, which lists offices in Palo Alto, California, and Sandnes, Norway, whose researchers watched the campaign unfold through control panels the attackers left open on the internet.

Image: Server racks in a data center, used for illustration. Photo: BalticServers.com, via Wikimedia Commons (CC BY-SA 3.0).

How the AI agents hacking campaign worked

Snorre Fagerland, principal threat researcher at NorForge, told Reuters the hacker “did almost none of the work.” Instead, the attacker handed targets to Cairn, an open-source platform that coordinates AI agents toward a goal, and let the agents spend hours probing sites for weaknesses on their own.

NorForge’s report describes Cairn as a step-by-step problem-solving engine. Each job starts at an “origin” and ends at a defined goal. Along the way, the agents post what they discover to a shared board and decide what to try next. In this campaign, the goal was usually to plant a small file-upload tool on a web server so the attacker could return later.

Key numbers from the Reuters and NorForge accounts:

• The most active attacker began on Sept. 25 and targeted e-commerce sites in the U.S., Canada, Australia and Japan.
• By late last week, the agents had attempted to break into more than 1,200 sites.
• Successful intrusions typically took about 23 hours of automated trial and error.
• Fagerland estimated the campaign used roughly $5,000 worth of AI tokens, or about $50 per successful hack.
• NorForge found more than 20 exposed Cairn panels it judged likely to be malicious.

The attacker’s instructions were short, fewer than 100 Chinese characters describing preferred intrusion tactics, according to Reuters. Fagerland estimated the campaign relied on a mix of China’s DeepSeek models and Anthropic’s Claude Code. NorForge’s report said the worker name it observed suggested a Claude Code setup running a DeepSeek model.

What the companies said

Reuters said it identified the victims by independently reviewing the hacker’s Cairn activity, since NorForge’s report did not name them. The news agency said it could not determine how much data, if any, was taken.

Deere told Reuters it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the intrusion hit a standalone site that carried only product support information and that the threat had been contained. Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” Two smaller businesses also acknowledged being compromised, Reuters reported.

Other attackers on exposed Cairn panels

NorForge grouped the activity into clusters. Besides the Chinese-language group, which it linked to 14 panels and more than 1,100 attack projects, it described an English-language cluster focused on financial theft. That group’s tasks openly talked about stealing credit cards and cryptocurrency, Reuters and NorForge said. One attacker stole a trove of credit card data, and another tried to get AI agents to rob a cryptocurrency exchange.

NorForge estimated that about 10% of the AI-driven attack projects it observed fully reached their goals, with many others gathering information that could be used later. It also found hundreds of exposed secrets, such as passwords and API keys, in the open panels. The firm said it was working with Reuters to notify victims and was trying to get the panels taken down.

Why it matters for corporate security

Fagerland said he had assumed hacker agents would still need some human supervision and that it was now clear the technology had moved past that. He described one case in which agents, after failing to find a weakness in a large company’s main application, searched public records for related systems, found an exposed control panel and eventually used a subtle flaw to run commands on the server. “It’s not script kiddie stuff,” he told Reuters.

The report adds to a string of warnings about AI being used on both sides of cybersecurity. Reuters noted that the Israeli firm Gambit Security documented AI-agent-driven breaches at 25 companies in September, and that cyber intelligence company Bitsight said discussions about autonomous agents were surging on criminal forums. Security vendors are racing to respond, as seen in Proofpoint’s $6.3 billion deal for Varonis, and AI is also flooding defenders with noise, as when Google paused part of its bug bounty over low-quality AI-generated reports.

For businesses, the practical lesson from the NorForge findings is familiar: patch public-facing software, retire forgotten admin panels and vendor sites, and watch for unexpected files on web servers. The difference now is the speed and low cost at which attackers can test those weaknesses.

What Cairn’s creator said

Cairn’s author, who uses the handle “le1xia0,” acknowledged a Reuters message but did not immediately answer questions. In a recent post on X, the developer wrote that the platform “was not designed for hacking attacks” and that harmful use “is not my intention,” Reuters reported. The Verge reported that the developer separately wrote that “misuse is a human decision, not a feature of the engine.”

“It’s a new world now,” Fagerland told Reuters.

Sources

• Reuters via Yahoo News: How one hacker used AI agents and a few thousand dollars to break into scores of sites
• NorForge: Inside Cairn, Open Windows into massive AI-Driven Cyber Operations
• The Verge: A hacker broke into John Deere and SharkNinja with an army of AI agents
• Wikimedia Commons: BalticServers data center photo (CC BY-SA 3.0)