Category: Security | Reading time: 4 min
What Happened
On 19 October 2026, Reuters reported that a Chinese-speaking hacker had broken into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins, while doing almost none of the work. The intrusions were carried out by AI agents running with little or no human supervision.
The findings come from Snorre Fagerland, principal threat researcher at the cybersecurity company NorForge, who provided his report to Reuters ahead of publication. Fagerland found the activity while scanning the internet for exposed instances of Cairn, an open-source multi-agent platform he described as popular with hackers. Beginning around 2 October, he identified about two dozen Cairn instances being used for malicious activity, which let him watch the operators' agents at work. Fagerland's report did not name victims; Reuters established their identities by independently reviewing the hacker's Cairn activity.
The Numbers
According to Fagerland's estimates as reported by Reuters:
- Start date: The campaign began on 25 September, targeting e-commerce websites in the United States, Canada, Australia and Japan. - Instructions: The hacker's tasking was written in fewer than 100 Chinese characters. - Scale: As of late last week, the agents had attempted to break into more than 1,200 sites. - Time per intrusion: Successful intrusions typically took around 23 hours of autonomous probing. - Cost: The campaign used roughly $5,000 worth of tokens, or about $50 per successful hack, and appeared to run on a mix of DeepSeek and Anthropic's Claude Code.
In one case described by Fagerland, the agents found no weakness in a large company's public-facing application, then searched records for associated infrastructure, located a public-facing control panel, found a subtle flaw in how it processed data, and after hours of trial and error reported using it to make the server execute commands. "It's not script kiddie stuff," Fagerland told Reuters.
How the Companies Responded
Reuters could not determine how much data, if any, was extracted. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was investigating a report of a potential attack on a website operated by one of its third-party vendors. Two smaller businesses also acknowledged being compromised.
Fagerland also observed other operators using Cairn: one stole a trove of credit card data, and another tried to get AI agents to rob a cryptocurrency exchange. Cairn's author, who posts as "le1xia0," wrote on X that the platform "was not designed for hacking attacks."
Why It Matters
Fagerland said he had assumed attacking agents would need at least some human supervision, and that this campaign showed the technology had moved past that. The report follows earlier agent-driven criminal campaigns cited by Reuters, including Gambit Security's findings in August and September and Bitsight's observation last week that discussions of autonomous agents were surging on cybercriminal forums.
For enterprises, two points stand out. First, the economics have changed: an attacker can now run a patient, 23-hour intrusion attempt against hundreds of targets for the cost of a few thousand dollars in model usage. Second, the weak points here were not the companies' main applications but adjacent infrastructure, such as control panels and vendor-operated sites, which agents are well suited to find because they do not tire of enumeration.
The same capability sits inside the agents enterprises are deploying themselves. An agent that can chain discovery, exploitation and command execution for an attacker can do the same things by mistake for its owner if it is given broad access and no external limit on what it may do. That is why regulators and security agencies have increasingly asked for controls that decide which agent actions are allowed before they run, and for records of those decisions that hold up after an incident.