One hacker used AI agents to breach more than 100 company websites for about $5,000

What the researcher found

As infosecu.technews.tw reported, citing a Reuters exclusive, a Chinese-speaking hacker handed nearly all of the attack work to AI agents over several weeks. The result was a breach of more than 100 company websites. Named victims include farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins.

The discovery came from Snorre Fagerland, lead threat researcher at security firm NorForge. While scanning the internet he came across several copies of a tool called Cairn that had been left publicly visible by accident.

How the agents worked

Cairn is an open-source platform on GitHub that coordinates several AI agents, splitting up the job of finding and exploiting weak spots in a system. Many hackers did not lock down its control panel, so Fagerland found more than 20 instances used for malicious activity and could watch the instructions passing between hackers and AI models.

The most active attacker wrote instructions of under 100 words describing a preferred method. The agents then probed on their own, averaging about 23 hours per successful break-in. Fagerland believes the mix of models was China's DeepSeek and Anthropic's Claude Code.

Not a beginner's trick

In one case, the agents could not find a flaw in a large company's public-facing application. They searched digital records to map the company's other infrastructure and picked out an exposed control panel. After hours of trial and error they found a subtle flaw in how it handled data and tricked the server into running malicious commands. Fagerland said this was well beyond amateur "script kiddie" work.

Deere said it has taken remedial steps and sees no sign that sensitive information was accessed. SharkNinja said the affected site was a standalone one holding only product-support information, and the threat is contained. Cummins said it is investigating a possible attack on a site run by a third-party vendor.

A growing pattern

Cairn's author said on X that it was not designed for hacking and that harmful use is not what he intended. Meanwhile, Gambit Security disclosed an agent-driven attack in September that hit 25 companies and stole at least 60 万 card records, and Bitsight says talk of agents is rising on cybercrime forums.

Fagerland had assumed criminals still needed human oversight when using agents. He now thinks AI has crossed that line.