One Hacker, a Team of AI Agents and About $5,000: Who’s Who in the Spree That Broke Into More Than 100 Company Websites

For years, the limit on how many companies one criminal could attack was the criminal’s own time. A new report suggests that limit is fading. Since late September, a lone hacker has given short instructions to a set of AI agents and let them spend hours, unattended, probing websites until they found a way in. Websites belonging to more than 100 companies were broken into.

The account comes from an exclusive Reuters report by Raphael Satter, built on research shared with the news agency before publication. Here is the story told through the people and things at the center of it.

The watcher

Snorre Fagerland, principal threat researcher at the security firm NorForge, went looking on the open internet for copies of an AI tool that had been left exposed by mistake. From around October 2 he found roughly two dozen being used for malicious work, and because they were exposed he could quietly watch what their operators were doing in real time. Fagerland, who has nearly three decades in the field, told Reuters the find showed commercially available agents carrying out complex intrusions from start to finish with no human stepping in.

The tool

The software is Cairn, an open-source AI platform for working through problems that Reuters describes as popular with hackers. Its author, who uses the handle “le1xia0,” wrote on X that it was built as a multi-agent architecture and not designed for attacks, and that harmful use was not the intention.

The hacker

Of the operators Fagerland observed, a Chinese-speaking hacker was the busiest. Starting September 25, this person pointed the agents at online stores in the U.S., Canada, Australia and Japan. Their instructions describing preferred attack methods ran to fewer than 100 Chinese characters. By late last week the agents had tried more than 1,200 sites.

The agents and the bill

A successful break-in usually took about 23 hours of automated trial and error.
The campaign appeared to run on a mix of DeepSeek and Anthropic’s Claude Code.
Fagerland estimated it consumed about $5,000 in AI usage, or roughly $50 for each successful compromise.
In one case, after finding nothing wrong with a large company’s main web application, the agents searched public records for related infrastructure, found an exposed control panel, spotted a subtle flaw in how it handled data and, after hours of attempts, reported getting the server to run their commands.

The companies

Fagerland’s report did not name victims. Reuters identified some by reviewing the hacker’s activity itself:

Deere said it had taken “necessary remediation actions” and saw no sign that sensitive information was accessed.
SharkNinja said a standalone site holding only product support information was affected and that the threat had been contained.
Cummins said it was investigating a report of a possible attack on a website run by one of its third-party vendors.
Two smaller businesses also confirmed being compromised; other listed victims did not respond.

Reuters could not determine how much data, if any, was actually taken.

The supporting cast

The Chinese-speaking operator was not alone. Another hacker Fagerland watched stole a large batch of credit card data, and a third tried to use agents to rob a cryptocurrency exchange. Reuters also points to separate research from Gambit Security and Bitsight showing AI agents spreading through the criminal underground.

What this means for your company

The agents in this story did not need a famous name to choose a target. They worked through long lists of ordinary online stores and kept going until something gave. That changes the math for smaller businesses: being too small to bother with is no longer much protection when the attacker’s time costs almost nothing.

List everything you have on the internet, not just the main website: online stores, support portals, staging sites, admin and control panels, and anything a vendor hosts on your behalf.
Take management panels off the public internet or put them behind a VPN or an extra login step.
Keep web platforms, plugins and hosting software patched, and ask your web and hosting vendors how quickly they apply security fixes.
Watch for long runs of unusual requests. An agent that spends a day probing a site leaves a trail in web server and firewall logs, and a web application firewall can slow it down.
Make sure someone is responsible for reviewing those alerts, whether that is an employee or an outside provider.

Need help finding and locking down the forgotten corners of your web presence before an automated attacker finds them? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.