A single attacker used autonomous AI agents to probe more than 1,200 websites, with over 100 reportedly compromised, according to a new cybersecurity investigation. The campaign began in late September and included websites associated with Deere, SharkNinja and Cummins.
What makes the operation unusual is how little hands-on work the attacker appears to have done. AI tools were left to search for weaknesses, change tactics and continue testing for hours. Some successful intrusions took almost a full day.
Snorre Fagerland, principal threat researcher at NorForge, documented the activity after finding AI systems exposed on the open internet. In an investigation published on 19 October, Reuters independently examined the activity records, identified affected organisations and obtained responses from several of them.
Few instructions, hours of searching
The attacks began around 25 September and focused on e-commerce websites in the United States, Canada, Australia and Japan. By late last week, the AI agents had attempted to break into more than 1,200 sites. Fagerland’s research linked over 100 successful compromises to the campaign.
The attacker operated through Cairn, an open-source platform for coordinating AI-powered tasks. Fagerland discovered the activity while looking for instances of Cairn that had inadvertently been made accessible online. He encountered several other people using the software maliciously, but the Chinese-speaking attacker behind this campaign was the most prolific.
The initial directions were surprisingly short. Fagerland found instructions setting out preferred intrusion tactics in fewer than 100 Chinese characters. From there, the agents worked through targets with limited supervision, trying different approaches when an obvious opening could not be found.
A successful attack typically involved around 23 hours of investigation. In one case described by Reuters, the agents could not break into a company’s main public-facing application. They went looking through records for other systems linked to the business, found an exposed control panel and spent hours testing a weakness before reporting that they could make the server run unauthorised commands.
That sort of persistence is the concern. Automated security scans have existed for years, but the agents in this campaign were able to pursue alternative leads rather than simply work through a fixed checklist. They were exploiting existing weaknesses, not necessarily discovering an entirely new kind of attack.
What Deere, SharkNinja and Cummins have said
Reuters identified several organisations in the attack records and asked them what had happened. Their responses are important because a compromised website is not automatically a breach of every system belonging to the company.
Deere, the agricultural machinery manufacturer, said it had taken remedial action and had no indication that sensitive information had been accessed.
SharkNinja said the affected site was a standalone website containing product-support information. The company said the threat had been contained.
Cummins said it was investigating a potential cyberattack involving a website operated by a third-party vendor. That does not establish that attackers entered Cummins’ internal network.
Two smaller businesses also acknowledged compromises. However, Reuters could not establish how much information, if any, had been extracted in the intrusions it examined. There is no basis at present to claim this campaign stole customer details from Deere, SharkNinja or Cummins.
Fagerland did observe a separate attacker stealing credit card data and another attempting to target a cryptocurrency exchange. Those incidents should not be confused with the 100-plus-site operation under investigation.
How much did the hacking campaign cost?
The researcher estimates that the attacker used roughly $5,000 worth of AI processing, or around $50 for each successful compromise. That is an estimate of computing costs, not a verified bill and certainly not a measure of the disruption suffered by the businesses involved.
The figures illustrate a practical shift. Rather than personally spending hours trying one approach after another, a criminal could send multiple agents off to work and check their progress later. This may allow an individual to test many more targets than would otherwise be realistic.
Fagerland believes the operation appeared to use a combination of China’s DeepSeek and Anthropic’s Claude Code. The reporting does not establish precisely what share of the work each handled. It does, however, show how existing AI services can be combined into a sustained attack workflow.
A neglected website can be enough
Older customer portals, supplier-operated websites and forgotten administrative interfaces are easy to overlook. A company may be vigilant about its main website while a smaller system stays online with weaker controls. For an attacker prepared to keep searching, those systems can offer another route in.
The UK National Cyber Security Centre’s guidance recommends prompt patching of internet-facing services, stronger access controls, properly configured multi-factor authentication and monitoring for suspicious activity. Businesses should also check which systems their suppliers operate and who can reach their administration pages.
For customers, the immediate advice is less dramatic. Being named in an investigation does not mean your personal account has been compromised. Watch for statements from the company concerned, use a different strong password for each service and be cautious about unexpected emails claiming you must urgently reset an account.
The same tension between capability and control is evident in the cybersecurity capabilities discussed in our earlier OpenAI Astra report. That involved model evaluation and safeguards. Here, a criminal was deliberately deploying readily available tools against real websites.
Cairn’s developer has said the platform was not designed for harmful hacking. Its intended purpose and the way the attacker used it are two different things.
Tech Torque Verdict
A website can be breached without customer data being stolen, and it is important not to blur that line. Even with the extent of data access unresolved, more than 100 reported compromises are serious enough to demand attention.
The bigger change is the workload. One attacker was able to put AI agents through hours of searching, testing and adapting across a huge list of targets. Companies already know they need to patch vulnerable systems and secure neglected services; automated attackers make the time available to find those gaps feel much shorter. The next answers needed are which systems were affected, what information was accessible and whether the companies involved have fully contained the intrusions.
