a chinese-speaking hacker used autonomous ai agents to break into the websites of more than 100 companies, reuters reported on oct 19. the victims include deere, sharkninja and cummins. the campaign cost about $5,000 in ai tokens, by the estimate of the researcher who found it.
how it was found
snorre fagerland of the security firm norforge scanned the web for open panels of cairn. it is an open-source platform that runs ai agents toward a set goal. he found more than 20 panels tied to malicious activity. they showed every target, the agents' progress and even stolen secrets. reuters identified the victims from the hacker's cairn data.
how the attacks worked
the hacker's tasks had fewer than 100 chinese characters of instructions each. most targets were e-commerce sites in the us, canada, japan and australia. by late last week, the agents had tried more than 1,200 sites, according to reuters.
a successful intrusion took a little under 23 hours on average, and about 10% of tasks reached their goal, according to norforge. fagerland put the cost at about $50 per successful hack. the agents ran on anthropic's claude code harness with deepseek's v4.1 flash model, by norforge's reading of the setup.
what the companies said
deere said it saw no sign that sensitive data was accessed. sharkninja said the attack hit a standalone support site and was contained. cummins said it was investigating a possible attack on a vendor-run site. cairn's author wrote on x that the platform was not designed for hacking.
cairn has appeared in such attacks before. in september, gambit security described a campaign that used it against hundreds of online retailers and took more than 600,000 credit card records.
sources
- reuters: how one hacker used ai agents and a few thousand dollars to break into scores of sites – oct 19, 2026; victims, company responses, $5,000 estimate (registration wall)
- norforge: inside cairn – oct 19, 2026; panels, worker names, success rate, time to goal
- gambit security: ai agents are hacking online retailers for $25 a company – the earlier campaign with cairn, 600,000+ card records
