One Hacker's AI Agents Broke Into 100-Plus Company Sites for About $5,000 in Tokens

A single Chinese-speaking hacker pointed a team of AI agents at more than 1,200 websites and broke into the sites of more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine manufacturer Cummins, Reuters reported on Monday. The researcher who watched it happen, Snorre Fagerland, principal threat researcher at the security firm NorForge, estimated that the entire campaign cost roughly $5,000 in AI tokens — about $50 for each successful compromise.

Fagerland found the operation by scanning the internet for exposed control panels of Cairn, an open-source AI problem-solving platform. In a report published Monday, NorForge says more than 20 exposed Cairn panels appeared to be tied to malicious activity, and that the panels were completely unprotected: anyone who found them could read the attacker's targets, instructions and results. The largest cluster, which NorForge calls AIA0001, writes in Chinese and ran more than 1,100 attack projects across 14 panels.

According to Reuters, that cluster began around September 25 and targeted e-commerce sites in the United States, Canada, Australia and Japan. The human operator issued strikingly short instructions — fewer than 100 Chinese characters describing preferred intrusion tactics — and then let the agents work autonomously. By late last week the agents had attempted intrusions into more than 1,200 sites. Successful breaches typically followed about 23 hours of automated probing, and NorForge estimates an average success rate of roughly 10 percent across the harnesses it observed.

The tooling mixture is notable: every task NorForge observed ran on a worker named "claudecode_deepseek-v4.1-flash", which suggests a Claude Code harness running DeepSeek's V4.1 Flash model. Reuters described the campaign as appearing to use a combination of DeepSeek and Anthropic's Claude Code. Neither company authorized or approved the activity; the names identify the tools the attacker apparently used, not any endorsement. NorForge logged about 140 recorded "facts" per project as the agents built up an understanding of each target.

The work went well beyond vulnerability scanning. In one case described to Reuters, after failing to find a weakness in a large company's public-facing application, the agents searched digital records for related infrastructure, located a public control panel, identified a subtle flaw in how it processed data, and after hours of trial and error used it to run commands on the server. "It's not script kiddie stuff," Fagerland told Reuters. Other Cairn users he tracked were uglier still: one stole a trove of credit card data, and another tried to aim agents at a cryptocurrency exchange.

The named victims tell three different stories. Deere said it had taken "necessary remediation actions" and had no indication that sensitive information was accessed. SharkNinja said the intrusion hit a standalone website carrying only product-support information and has been contained. Cummins said it was investigating a potential attack on a site operated by a third-party vendor. Reuters could not determine how much data, if any, was taken from the breaches. Two smaller businesses separately acknowledged being compromised.

Cairn's author, known online as "le1xia0", acknowledged a Reuters message but did not answer detailed questions, saying in a recent post that the platform is a multi-agent problem-solving architecture not designed for attacks. The incident lands in a crowded quarter for AI-enabled crime: Israeli firm Gambit Security documented Russian-speaking extortionists using the Cursor coding tool to break into organizations, and cyber intelligence firm Bitsight reported last week that discussion of autonomous agents is surging on criminal forums.

For defenders, the economics are the headline. An operator with no visible team, no zero-day budget and about $5,000 of tokens ran a persistent, adaptive campaign against four countries' e-commerce infrastructure for weeks. Fagerland, who has spent nearly three decades in the field, said he long assumed hacker-agents would still need a human steering them; he no longer does. "The development in this field is astounding," he said. Security teams may want to re-examine their forgotten admin panels and vendor portals first — that is where these agents found their way in.