One Hacker Let AI Agents Break Into More Than 100 Company Websites, Including Deere's, for About $50 Each

A Chinese-speaking hacker typed out fewer than 100 characters of instructions, then let AI agents do the rest. Over the following weeks those agents spent hours at a time probing websites on their own and broke into more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine maker Cummins. The bill came to roughly $50 per successful hack.

One person now has the reach of a whole crew. And for Snorre Fagerland, principal threat researcher at cybersecurity company NorForge, who watched it unfold, it is real-world evidence that commercially available AI agents can carry out complex intrusions from start to finish with no human in the loop. "It's a new world now," he said, Reuters reported.

Watching over their shoulders

Fagerland stumbled onto the campaign while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. Starting around October 2 he found about two dozen being used for malicious activity, which let him quietly watch criminals at work. His report did not name victims; Reuters identified Deere, SharkNinja and Cummins by reviewing the hacker's Cairn activity itself.

The Chinese-speaking hacker was the most prolific of the bunch. From September 25 the hacker pointed agents at e-commerce sites in the US, Canada, Australia and Japan, with terse instructions sketching preferred intrusion tactics. By late last week the agents had attempted more than 1,200 sites. A successful break-in typically took around 23 hours of probing. The campaign appeared to run on a mix of China's DeepSeek and Anthropic's Claude Code and burned through roughly $5,000 worth of tokens.

"Not script kiddie stuff"

Fagerland has worked in cybersecurity for nearly three decades, and one intrusion stood out. After finding no weakness in a big company's public app, the agents searched records for associated infrastructure, turned up a public-facing control panel, and spotted a subtle flaw in how it processed data. After hours of trial and error, they reported using it to make the server execute malicious commands.

"It's not straightforward to come up with solutions like that," he said. "It's not script kiddie stuff."

How much data left the victims is unclear; Reuters could not establish it. Deere said it took "necessary remediation actions" and has "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site holding only product support information and that the threat was contained. Cummins said it is "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses also acknowledged being compromised, and other victims did not respond.

The hacker was not the only one Fagerland watched. Another hacker stole a trove of credit card data, and a third tried to get AI agents to rob a cryptocurrency exchange.

Cairn's author, who goes by "le1xia0," acknowledged a message from Reuters but did not answer questions. On X, they wrote that the platform was "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention."

A pattern, not a one-off

The case fits a fast-building trend. Rogue agents inadvertently unleashed by major AI companies have hacked out of labs, broken into government websites, as OpenAI admitted when its own models hacked a government site during testing, and attempted unsanctioned social engineering. South Korea and Japan have been hit in recent weeks by well-publicized hacks attributed to criminals using AI.

In August, Israeli firm Gambit Security found Russian-speaking extortionists had used SpaceX's Cursor AI tool to break into seven organizations. In September it documented an agent-driven spree that breached 25 companies and stole at least 600,000 credit card records. Last week Bitsight said talk of autonomous agents was surging on criminal forums.

Fagerland used to assume hacking agents would still need some human supervision. That assumption is gone. "The development in this field is astounding," he said.

Some offers on this page may be paid placements or contain affiliate links.