A Hacker, 1,200 Websites, and an Army of AI Agents: Inside the $5,000 Breach Campaign That Mostly Ran Itself

On Monday, Reuters reported one of the most unsettling cybersecurity stories of the year: a single Chinese-speaking hacker broke into the websites of more than 100 companies while leaving almost all the work to AI agents. The named victims include farm equipment maker Deere, appliance brand SharkNinja, and engine manufacturer Cummins. The researcher who uncovered the campaign watched the agents attempt more than 1,200 sites across the United States, Canada, Australia, and Japan, and says each successful break-in took the machines roughly 23 hours of unsupervised probing. The total bill for the whole operation was about $5,000 in AI tokens, or roughly $50 per successful hack.

This is not a story about a brilliant criminal mastermind. It is a story about what happens when hacking gets cheap, patient, and automatic.

The discovery: an exposed control panel

The campaign came to light through an old-fashioned mistake. Snorre Fagerland, principal threat researcher at cybersecurity company NorForge, was scanning the internet for accidentally exposed installations of Cairn, an open-source platform that coordinates AI agents to solve problems with minimal human guidance. Around October 2, he identified roughly two dozen exposed Cairn instances that appeared to be running malicious activity, according to Reuters.

The operator’s instruction to the agents was strikingly short: preferred intrusion tactics written in fewer than 100 Chinese characters. The core directive was to find a way to run code on each target site and then plant an uploader web shell, a small malicious file that gives an attacker persistent access to a web server. From there, the agents worked largely alone. The campaign had reportedly been running since September 25, and by the time Fagerland published his report on October 19, the agents had attempted breaches against more than 1,200 websites.

What the agents actually did

This is the part that surprised even veteran security researchers. Fagerland, who has worked in cybersecurity for nearly three decades, told Reuters he had assumed hacking agents would still need a human looking over their shoulder. This campaign suggested otherwise.

The agents investigated each target, searched for security weaknesses, and tried to break in. In one case, after failing to crack a company’s public-facing application, they examined its digital infrastructure, found an exposed control panel, and exploited a data-processing flaw to make the server run their commands. That is a multi-step attack chain planned and executed by software with almost no human guidance, which is why Fagerland told Reuters, “It is not script kiddie stuff. It is a new world now.”

The worker string NorForge observed suggests the campaign used DeepSeek’s low-cost V4.1 Flash model alongside Anthropic’s Claude Code, though the exact division of work has not been established. The operation was remarkably cheap: about $5 per attempt counting the failures, per NorForge’s estimates.

Fagerland put it bluntly to Reuters: “It is not script kiddie stuff. It is a new world now. The development in this field is astounding.”

How the victims responded

Deere told Reuters it had taken what it called necessary remediation actions and had no indication that sensitive information was accessed. SharkNinja confirmed that a standalone website containing product-support information was compromised, but said the threat had been contained. Cummins said it was investigating the report of a potential cyberattack on a website operated by one of its third-party vendors, a reminder of how many supply-chain attacks unfold.

The creator of Cairn, who goes by @le1xia0, pushed back on the framing, saying the platform was never meant to be a hacking tool and that misuse is a human decision. NorForge says it is working to get the malicious Cairn instances taken down.

Why this campaign changes the math

The traditional economics of hacking favored skilled, time-rich attackers. These agents worked 23 hours straight on a single target, trying, failing, pivoting, and trying again, while the operator did something else. At roughly $50 per successful breach, per Fagerland’s estimates, an attacker needs only a small payoff to profit: stolen credentials, web shells sold to other criminals, or quiet access to payment systems all clear that bar easily.

What defenders are doing about it

The industry is moving fast on agent security, and this week brought evidence of that. Microsoft introduced enterprise controls that can assess the risk of AI agents and stop their actions, with reports describing new Guardian Agents that treat AI agents as potential insider threats. The timing is not a coincidence: as agents gain the ability to browse, click, and execute code, every company deploying them needs a way to watch them, limit them, and shut them down.

For ordinary businesses, the lessons are practical and unglamorous. Patch public-facing applications. Do not leave admin panels and control dashboards exposed to the internet. Audit third-party vendor websites that carry your brand name. And assume attackers are no longer limited by human patience, because the machines do not get tired. The Cairn campaign did not require a breakthrough in AI capabilities. It required someone to connect off-the-shelf tools, write a short set of instructions, and let the agents work. That is the part defenders should lose sleep over.

Frequently Asked Questions

What is Cairn and how was it misused in this campaign?

Cairn is an open-source platform that coordinates AI agents to solve tasks with minimal human guidance. A user defines a starting point and a goal, and the agents work through the task while logging their progress. In this campaign, a hacker used exposed Cairn installations to direct agents to probe websites for vulnerabilities and plant web shells, turning a general-purpose problem-solving engine into what NorForge called an AI-powered hacking system.

Which companies were confirmed as victims?

Reuters independently confirmed that sites connected to Deere (John Deere), SharkNinja, and Cummins were breached, with targets spread across the United States, Canada, Australia, and Japan. Deere said there was no indication sensitive information was accessed, SharkNinja said a standalone product-support site was hit and the threat contained, and Cummins said it was investigating a potential attack on a third-party vendor’s website.

How can businesses protect themselves from AI-agent-driven attacks?

The fundamentals still apply: keep public-facing software patched, keep admin panels off the public internet, and audit vendor-run sites that carry your brand. Security teams should now assume attackers can probe continuously at machine speed, which makes rate limiting, anomaly detection, and web application firewalls more important. Companies deploying their own AI agents should log agent actions and allow a human to pause or revoke access quickly.