One Hacker's AI Agents Broke Into Scores of Company Sites

A single hacker's AI Agents broke into more than one hundred company websites after probing well past a thousand of them, outsourcing nearly the entire attack to software that planned and executed each intrusion on its own, according to Reuters.

The campaign came to light because the attackers got sloppy in a very human way. They left the control panels of their AI setup exposed on the open internet, and a cybersecurity researcher spent about two weeks quietly watching them work before sounding the alarm.

Snorre Fagerland, a principal threat researcher at the AI security firm NorForge, traced the operation to Cairn, an open-source platform that lets people define a starting point and an end goal and then turns AI Agents loose to work out the steps in between. Fagerland told Reuters he found roughly two dozen exposed Cairn instances being used for malicious activity beginning in early October, and one cluster alone ran more than eleven hundred attack projects across fourteen panels.

The targets spanned the United States, Canada, Australia and Japan, and the list was not small fry. Reuters independently reviewed the hacker's Cairn activity and named farm equipment giant Deere, appliance maker SharkNinja and engine manufacturer Cummins among the victims. The goal, NorForge says, was lasting access to shop and payment systems, with the endgame of stealing money.

How the autonomous attacks worked

What stunned researchers was how little the hacker had to say. The instructions steering the most prolific cluster ran to fewer than one hundred Chinese characters, yet the AI Agents handled reconnaissance, vulnerability discovery and exploitation with limited human supervision. They interpreted a broad objective, worked through intermediate tasks, evaluated results and kept going without close direction.

In one case described by Fagerland, the agents dug through digital records for infrastructure tied to a target, found a public-facing control panel, spotted a weakness in it and used that opening to trigger malicious command execution. The researcher called the technique sophisticated rather than indiscriminate. "It's not straightforward to come up with solutions like that," he told Reuters. "It's not script kiddie stuff."

The agents chained small flaws together rather than relying on one devastating vulnerability. They checked for bad file uploads and login bypasses, probed for ways to run code without signing in, and in one cluster the standing instruction to the agents was simply to upload a web shell "in hidden dirctory" — typos included. The misspellings are a useful reminder that behind the autonomous machinery was a careless human.

The economics are the scary part

Speed and cost are what turned this from a neat hack into a warning. Successful breaches took a little under twenty-three hours on average, and Fagerland estimated the whole campaign burned roughly five thousand dollars in AI tokens, which works out to about fifty dollars for each successful break-in. For context, that is less than a single hour of commercial penetration testing at most firms, spent instead on compute time for software working largely unsupervised.

That labor math is why security people are paying attention. Pulling off a coordinated intrusion campaign against well-known companies once required a team of specialists and serious funding. This one appears to have required one operator, a short prompt and a credit card for tokens. The success rate sat near ten percent, but at these costs a hacker can afford to miss nine times out of ten.

Researchers have been careful not to overstate what is confirmed. There is no verified evidence yet of a named individual behind the keyboard, no confirmed headcount beyond the description of one hacker, and Reuters could not establish how far any breach went toward pulling data out. The linguistic clue points to a Chinese-speaking operator, but attribution in cases like this has burned investigators before.

What the targets said

Deere said there was no indication that sensitive information was accessed. SharkNinja confirmed that a standalone support site had been compromised but said the threat had been contained. Cummins said it was investigating the report of a potential cyber attack on a website operated by one of its third-party vendors. None of the companies described customer data being taken, and the corporate responses were reported by Oossa alongside the broader findings.

The timing sharpened the debate about who is responsible when software commits crimes. The same week the report surfaced, Microsoft introduced enterprise controls meant to assess agent risk and stop risky agent actions before they run, a sign that the biggest platform companies now treat agent misuse as a when, not an if. The tension is obvious: Cairn is marketed as a general-purpose problem-solving engine, and the same functionality that helps a startup automate research can be pointed at someone else's servers.

For young internet users the takeaway is practical rather than paranoid. Autonomous agents are about to become as common as chatbots, which means the attacks they enable will scale the way spam did. Patching, unique passwords and skepticism about strange logins were built for a world where every attack cost a human hour of labor. That world is ending, and the new math looks like this: fewer than one hundred characters of instructions, a small stack of tokens, and hundreds of companies in the crosshairs.

More from the newsroom: AI Agents are already being trusted with real money in a new Visa and BILL pilot, and the power demands of the AI boom are pulling old coal towns back into the energy business.