Over the past couple of weeks, a cybersecurity researcher watched a single Chinese-speaking hacker break into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins. The hacker did almost none of the work personally. According to Snorre Fagerland, principal threat researcher at NorForge, in a report provided to Reuters ahead of publication on Monday, October 19, the intrusions were outsourced almost entirely to AI agents that spent hours autonomously probing and breaking into targeted sites.
Fagerland found the campaign while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. Beginning around October 2, he found about two dozen instances of Cairn being used for malicious activity, which let him quietly watch over the criminals' shoulders. The most prolific hacker he observed began on September 25, gave their agents instructions sketched out in fewer than 100 Chinese characters, and set them loose on e-commerce sites in the United States, Canada, Australia and Japan. By late last week the agents had attempted to break into more than 1,200 sites.
The economics are the uncomfortable part. Successful intrusions typically took about 23 hours of automated probing, and Fagerland estimated the campaign, which appeared to use a mixture of DeepSeek models and Anthropic's Claude Code, consumed roughly 5,000 dollars worth of tokens, or about 50 dollars per successful hack. This was not simple automated scanning, either. In one case, after finding no weakness in a large company's public application, the agents searched digital records for associated infrastructure, found a public-facing control panel, spotted a subtle flaw in how it processed data, and after hours of trial and error tricked the server into executing malicious commands. "It's not straightforward to come up with solutions like that," Fagerland said. "It's not script kiddie stuff."
The victims' responses underline how ordinary the exposure was. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the breach hit a standalone site carrying only product support information and that the threat was contained. Cummins said it was investigating a report involving a website operated by a third-party vendor. Reuters could not establish how much data, if any, was actually extracted, and Fagerland found other actors in the same exposed Cairn panels too, including one who stole a trove of credit card data and another who tried to direct agents to rob a cryptocurrency exchange.
For anyone building with agents, the lesson is not that a new superweapon exists. It is that the unit cost of a competent, patient intruder has collapsed, and persistence is now cheap. The same pattern Fagerland saw, a short instruction followed by a full day of unsupervised probing, is exactly how legitimate coding and research agents are meant to work. Defense has to assume that tempo: close exposed control panels and agent dashboards, patch the forgotten vendor and support sites attackers reach first, watch for long, methodical probing rather than only loud bursts, and keep human review on the actions your own agents can take. As Fagerland put it, "It's a new world now." Builders who treat agent security as a launch checklist, rather than a running cost, are going to learn that the hard way.
