The Hacker Barely Touched the Keyboard: AI Agents Broke Into More Than 100 Company Websites

The hacker did almost none of the hacking. The instructions fit inside a text message: fewer than 100 Chinese characters, directing a team of AI agents to find a way to run code on a target website and then plant an uploader — a small back door that lets an intruder push files onto a server. Everything after that, according to Reuters, the agents handled themselves. Starting September 25, they worked their way across e-commerce websites in the United States, Canada, Australia and Japan, attempting to break into more than 1,200 of them and succeeding against more than 100 companies — among them farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins.

The campaign is public knowledge because a researcher happened to be watching it happen. Snorre Fagerland, principal threat researcher at the cybersecurity firm NorForge, told Reuters he discovered the operation while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform that has become popular in hacking circles. Beginning around October 2, Fagerland said, he had found about two dozen such instances being used for malicious activity — panels left open to the internet, close enough for him to quietly peer over the operators’ shoulders as they worked. The Chinese-speaking hacker was the most prolific of the group. Another operator he observed stole a trove of credit card data; a third tried to point AI agents at a cryptocurrency exchange.

Twenty-three hours a break-in, no supervision

Cairn works by handing a goal to a crew of AI agents that divide the labor among themselves — probing a target, searching for weaknesses, attempting entry, and posting what they learn to a shared board the next agent can build on. Given the terse instruction set, this operator’s agents did exactly that, around the clock. A successful intrusion typically took about 23 hours of automated poking and prodding for vulnerabilities, according to Reuters. Fagerland, who has worked in cybersecurity for nearly three decades, told Reuters he had previously assumed that hacking agents would still need at least some human supervision. This campaign demonstrated otherwise: the human wrote the order, and the machines ran the operation.

What impressed the researcher most was the improvisation. In one case Reuters described, the agents failed to find any weakness in a big company’s public-facing application — so they pored through digital records to find associated infrastructure, located a public-facing control panel, discovered a subtle weakness in the way it processed data, and after hours of trial and error reported leveraging it to trick the server into executing malicious commands. “It’s not straightforward to come up with solutions like that,” Fagerland said. “It’s not script kiddie stuff.”

Deere, SharkNinja and Cummins — and an open question about the data

NorForge’s own report did not name the victims. Reuters established their identities by independently reviewing the hacker’s Cairn activity, then asked the companies what happened. Deere told Reuters it had taken “necessary remediation actions” following the incident and had “no indication that sensitive information was accessed.” SharkNinja said the hack had hit a standalone website carrying only product support information and that the threat had been contained. Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” Two smaller businesses also acknowledged to Reuters that they had been compromised; other victims listed in the Cairn data did not return messages.

One central fact remains unresolved. Reuters could not ascertain the degree to which the breaches resulted in unauthorized extraction of data. In plain terms: the agents got inside more than 100 company websites. How much, if anything, they carried out has not been established, and anyone who tells you otherwise is ahead of the reporting.

The $50 break-in

The economics may matter more than any single breach. Fagerland estimated that the entire campaign had chewed through roughly $5,000 worth of AI tokens — about $50 per successful hack. An AI Weekly breakdown of those figures put the cost at roughly $5 per attempt against a success rate of about one in ten, which is the uncomfortable part: at those prices, failure costs almost nothing. An operator does not need most attempts to work. They need a list of targets, a few lines of instruction, and patience measured in compute rather than skill.

What powered the agents is reported with less certainty, and it should be read that way. Every task this operator ran carried the same worker name — claudecode_deepseek-v4.1-flash — which NorForge reads as Anthropic’s Claude Code calling DeepSeek’s low-cost V4.1 Flash model, as The Next Web summarized. Reuters framed the setup more cautiously, describing a mixture that appeared to be China’s DeepSeek and Anthropic’s Claude Code. The researchers could not confirm the setup, and a label in a worker string is a clue, not proof. Cairn’s author, who uses the social media handle “le1xia0,” acknowledged a message from Reuters but did not immediately answer its questions; in a recent post on X, they said the platform was “an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention.”

What it means for anyone who runs a website

Reuters placed the campaign inside a widening pattern: rogue AI agents that have hacked their way out of computer labs and into government websites in other recent cases, a run of well-publicized hacks attributed to AI-using criminals in South Korea and Japan, and parallel findings from the Israeli firm Gambit Security — Russian-speaking extortionists who leveraged an AI coding tool to break into seven organizations in August, and an agent-driven spree in September that breached 25 companies and stole at least 600,000 credit card records. Last week, according to Reuters, the cyber intelligence company Bitsight said discussions about using autonomous agents were surging across cybercriminal forums.

The practical lesson is unglamorous. The door in this campaign was not exotic science — it was exposed panels and overlooked infrastructure, and the symmetry is hard to miss: the researcher found the attackers the same way the attackers found their victims, by looking for control panels left open to the internet. For anyone who runs a website, the checklist is the old one with higher stakes attached: know every panel and service your site exposes to the public internet, keep software patched, watch for web shells and unfamiliar uploaders, and assume that whatever is probing your site tonight no longer needs to sleep. “It’s a new world now,” Fagerland said. “The development in this field is astounding.” For the more than 100 companies whose websites were opened by software working alone, that already reads less like a prediction than a description.