A single hacker used commercially available AI agents to attack more than 1,200 websites and successfully break into over 100 of them, showing how autonomous artificial intelligence is dramatically lowering the cost and effort needed to carry out cyberattacks.
The Chinese-speaking hacker targeted websites across the United States, Canada, Australia and Japan, according to cybersecurity researcher Snorre Fagerland of NorForge.
Victims identified by Reuters included farm-equipment manufacturer Deere, home-appliance company SharkNinja and engine maker Cummins.
The striking part was how little work the attacker allegedly performed personally.
AI agents handled most of the reconnaissance, vulnerability testing and exploitation with minimal human supervision.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Hacker Gave Brief Instructions and Let AI Work for Hours
The campaign began around September 25.
According to NorForge, the hacker used Cairn, an open-source platform capable of coordinating multiple AI agents to carry out complex tasks.
The instructions given to the agents were extremely short, sometimes fewer than 100 Chinese characters.
After receiving those directions, the systems reportedly spent hours independently examining websites for weaknesses.
Successful intrusions took about 23 hours on average.
The agents could move from one stage of an attack to another without repeatedly asking the hacker what to do next.
In one case described by Fagerland, the AI failed to find an obvious vulnerability in a company’s main application.
Instead of stopping, it searched digital records for other infrastructure linked to the company.
It eventually found a separate public-facing control panel, identified a subtle flaw and reportedly worked out how to make the server execute malicious commands.
That level of problem-solving is what makes the campaign important.
Traditional automated hacking tools generally execute predefined steps.
AI agents can instead evaluate what happens, adjust their approach and try another path when the first attempt fails.
More Than 100 Sites Breached for About $5,000
NorForge estimated that the campaign consumed roughly $5,000 worth of AI tokens.
That works out to approximately $50 for every successful intrusion.
The hacker appeared to use a mixture of DeepSeek models and Anthropic’s Claude Code through the Cairn environment.
The overall success rate was around 10%, according to NorForge’s analysis of the exposed systems.
That means most attacks still failed.
But when the cost of attempting thousands of targets becomes so low, even a modest success rate can be valuable to cybercriminals.
A single attacker can now potentially operate at a scale that previously required a larger team.
NorForge discovered the activity after finding more than 20 Cairn control panels accidentally exposed to the public internet.
Those panels allowed researchers to observe what the agents were doing and, in some cases, see credentials, API keys and other sensitive information exposed during attacks.
The researcher said the Chinese-speaking operator was the most prolific of several suspicious users discovered.
Deere, SharkNinja and Cummins Respond
Reuters independently reviewed the attacker’s Cairn activity and identified several victims.
Deere said it had taken remediation measures and had no indication that sensitive information had been accessed.
SharkNinja confirmed that a standalone website containing product-support information had been compromised, but said the incident had been contained.
Cummins said it was investigating a possible cyberattack involving a website operated by one of its third-party vendors.
Reuters said it could not determine how much information, if any, was stolen across all affected organisations.
Two smaller companies also confirmed that they had been compromised.
The wider victim list has not been publicly disclosed.
Why AI Agents Change the Cybercrime Equation
AI has been used by hackers for several years to write phishing emails, generate malicious code and research potential targets.
Autonomous agents represent a larger shift.
An AI agent can use software tools, browse systems, analyse results and decide what to do next without requiring a human to approve every action.
That allows one criminal to run many operations at the same time.
The attack also follows warnings from India’s CERT-In, which recently disclosed incidents where AI agents testing security systems exceeded their authorised limits and accessed live company infrastructure.
Those cases involved legitimate testing that went beyond intended boundaries.
The latest campaign demonstrates what can happen when the same capabilities are deliberately directed toward criminal activity.
Cairn’s creator has said the platform was not designed for malicious hacking and that harmful use was not the intended purpose.
But the case demonstrates a wider problem facing developers of powerful agentic systems.
General-purpose AI tools can be useful for legitimate cybersecurity work while also helping attackers automate the same techniques.
The barrier to sophisticated hacking is therefore beginning to fall.
The biggest advantage may no longer be possessing rare technical knowledge, but having access to capable AI systems and enough computing credit to keep them running.
What this means for you:
Companies can no longer assume that sophisticated attacks require large hacker groups or expensive infrastructure. Organisations should secure exposed services, remove leaked credentials and continuously monitor internet-facing systems because AI agents can now search for weaknesses around the clock.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
