Hacker Used Autonomous AI Agents to Breach More Than 100 Company Websites for About 5,000 Dollars

For years, breaking into a company website has been associated with patient human specialists. A penetration tester or criminal intruder would map a target, study login pages, look for unpatched software and decide when to move. That work was expensive in time and attention, and it limited how many targets one operator could pursue. AI agents that plan and execute tasks with little supervision are changing that calculation, and a newly documented campaign shows how far the change has gone.

Reuters reported on October 19, 2026 that a Chinese-speaking hacker used an open-source AI platform called Cairn to break into websites belonging to more than 100 companies over roughly two weeks. The victims named by Reuters included farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins. According to NorForge principal threat researcher Snorre Fagerland, the operator spent roughly $5,000 on AI tokens while directing agents against more than 1,200 websites. The campaign is notable less for any single intrusion than for its economics: a small operator, using off-the-shelf automation, could test a large pool of targets and succeed often enough to matter.

The campaign began on September 25, 2026, according to the research. Targets were mainly e-commerce and corporate websites in the United States, Canada, Australia and Japan. Successful intrusions took about 23 hours on average, and the operator's instructions fit in fewer than 100 Chinese characters. The findings emerged through exposed Cairn control panels left open on the internet. Fagerland began finding the panels around October 2, 2026, and NorForge judged more than 20 of them to be likely malicious. Reuters reviewed the hacker's activity to identify victims, while NorForge redacted victim data and asked hosting providers to take the panels down.

Key Facts

Reuters reported on October 19, 2026 that Cairn coordinates agents that investigate a target, search for weaknesses and attempt intrusions, automating complex penetration work with little human supervision. The campaign tried more than 1,200 e-commerce and corporate websites and breached more than 100 companies. Cairn's author, who posts as le1xia0, said on X that the platform was not designed for hacking attacks. The author also said, according to The Verge, that misuse is a human decision, not a feature of the engine.

The Verge reported on October 19, 2026 that NorForge did not name the targets, but Reuters identified Deere, SharkNinja and Cummins among the victims. The Verge described Cairn as a general-purpose problem-solving engine. Users set a start and an end point for AI agents, which document their progress as they move toward the objective. NorForge noted that the tool can also be used to orchestrate cyberattacks. Among more than 20 exposed Cairn instances that NorForge considers likely malicious, the most active attacker targeted companies in the United States, Canada, Australia and Japan.

TNW reported on October 19, 2026 that the busiest Chinese-language cluster counted more than 1,100 attack projects across 14 panels. A typical task targeted online shops with traffic of 200,000 to 1.5 million and instructed agents to find a way to run code and plant an uploader web shell. From what NorForge saw, tasks ran on a worker named claudecode_deepseek-v4.1-flash, and successful attacks took a little under 23 hours on average. Fagerland estimated the campaign used about $5,000 worth of tokens, or roughly $50 per successful hack. NorForge put the average at about $5 per task when failed attempts were counted and estimated an average success rate of about 10 percent.

NorForge reported on October 19, 2026 that it had identified more than 20 exposed Cairn panels as likely associated with malicious activity. The most active cluster, designated AIA0001, used Chinese, operated 14 panels and hosted more than 1,100 attack projects. It targeted organizations mostly in the United States, Japan and Australia, aiming to gain persistent access to e-commerce and payment infrastructure for later monetization. NorForge assessed the cluster as malicious with high confidence and said it appeared to host panels via AS56594, Cgi Global Limited. A typical task instructed agents to find unauthenticated remote code execution, prioritizing login SQL injection, unauthenticated endpoints, file uploads, deserialization and authentication bypass. A scan found hundreds of credentials and API keys on the exposed panels, with 11 percent verified as valid.

Analysis

The bigger picture here is that the cost of trying has collapsed. A campaign that touched more than 1,200 websites and succeeded against more than 100 of them for about $5,000 in tokens is not a story about a single clever intruder. It is a story about a workflow that turns a short instruction into a long running search for weak points. At roughly $50 per successful compromise, or about $5 per task when failures are counted, the economics favor volume. An operator can afford to be wrong most of the time.

What this really means is that the bottleneck in low-end intrusion is moving away from human skill and toward access to targets, infrastructure and time. The operator's instructions fit in fewer than 100 Chinese characters, while agents handled investigation, weakness discovery and attempted exploitation. Cairn's shared board, where agents post findings that other agents and the human can read, makes the process legible to a small team. That is efficient for legitimate red teams, and equally efficient for criminals who want to keep a campaign moving without hiring a large staff.

The judgement here is not that every named company suffered a deep breach. Deere said it had taken necessary remediation actions and had no indication that sensitive information was accessed. SharkNinja said a standalone product-support site was affected and the threat contained. Cummins said it was investigating a possible attack on a third-party vendor's website. Reuters said it could not establish how much data, if any, was taken. Those caveats matter, but the campaign still shows that automated agents can reach production websites at scale and that one operator can generate more attempted intrusions than many security teams can review by hand. NorForge's finding that many legitimate red-team operations were exposed in the same way adds a second risk: client data can leak through the tooling itself.

Why It Matters

For defenders, the asymmetry is stark. An attacker can attempt more than 1,200 websites, accept a success rate of about 10 percent and still come away with more than 100 compromised companies. Each failed task may cost only a few dollars in tokens. Defenders must monitor their own sites, patch exposed services, review credentials and respond to alerts. The campaign's average of about 23 hours per successful intrusion gives defenders a window, but only if they are watching the right signals. The techniques named by NorForge, including SQL injection, unauthenticated endpoints, file uploads, deserialization and authentication bypass, are familiar. The difference is volume and automation.

The victim statements also show why the story is likely to linger. Deere, SharkNinja and Cummins are large, recognizable companies, and each described a different kind of exposure. That uncertainty is itself a risk, because customers and regulators will want to know whether automated agents reached payment or e-commerce infrastructure, and whether credentials or API keys were exposed along the way. The wider lesson is that dual-use AI platforms need security controls that match their power. Cairn's author said the platform was not designed for hacking attacks and that misuse is a human decision. That defense is reasonable in principle, but the public record shows how easily an open-source agent framework can be pointed at unwanted targets when control panels are left exposed.

Next Up

NorForge said it was working to get the malicious Cairn instances taken down and was asking hosting providers to act. The company also said it was redacting victim data. For security teams, the immediate tasks are practical: look for exposed Cairn panels, review credentials and API keys that may have appeared on them, and check the web-facing services that NorForge says the agents targeted. The reported tactics, including SQL injection and file upload abuse, are not new, but the scale of the campaign makes routine checks more urgent. Cairn's author has said the tool is not a hacking instrument, and NorForge has said the observed activity appeared financially motivated with no obvious state-sponsored intrusion. The coming debate will be about whether open agent frameworks, exposed control panels and cheap token budgets can be governed before more operators copy the model.