A Chinese-speaking hacker used autonomous AI hacking agents to breach websites belonging to more than 100 companies in a campaign that began on September 25, 2026, according to NorForge researcher Snorre Fagerland. The hacker delegated almost all the work to software, with successful intrusions typically taking about 23 hours and costing an estimated $50 in AI tokens each.
Key takeaways
Deere, SharkNinja and Cummins were among the identified victims.
The agents attempted intrusions against more than 1,200 websites.
Fagerland estimated the campaign’s total token spending at roughly $5,000.
The scale of unauthorized data extraction remains undetermined.
Autonomous AI hacking reaches company websites worldwide
The campaign targeted e-commerce websites in the United States, Canada, Australia and Japan. By late last week, agents acting for the Chinese-speaking hacker had attempted to penetrate more than 1,200 sites, successfully entering websites belonging to over 100 companies.
While scanning the internet for accidentally exposed deployments of Cairn—an open-source AI problem-solving platform favored by hackers—NorForge’s principal threat researcher Fagerland discovered this malicious activity. Starting around October 2, he identified roughly two dozen compromised instances, which allowed him to observe the attacks unfold in real time.
Reuters conducted its own independent examination of the hacker’s Cairn activity and found that victims included farm equipment maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins. Fagerland’s report did not name the affected businesses.
The Chinese-speaking hacker was the most prolific of those Fagerland observed. Another hacker stole credit card data, while a separate actor tried to direct AI agents to rob a cryptocurrency exchange.
Fewer than 100 characters set hours of attacks in motion
The hacker supplied instructions in fewer than 100 Chinese characters, outlining preferred intrusion tactics. The agents then spent hours searching for weaknesses and attempting to exploit them.
Fagerland estimated that the campaign appeared to combine China’s DeepSeek and Anthropic’s Claude Code. He put its token expenditure at roughly $5,000 overall, or about $50 for each successful intrusion. Successful attacks typically required around 23 hours of probing.
In one case, agents failed to find a weakness in a large company’s public-facing application. They searched digital records for related infrastructure, found an internet-accessible control panel and identified a subtle flaw in its data processing. After hours of trial and error, they reported exploiting that weakness to make the server execute malicious commands.
Fagerland, who has worked in cybersecurity for nearly three decades, described the technique as sophisticated. “It’s not straightforward to come up with solutions like that,” he said. “It’s not script kiddie stuff.”
Companies describe containment as data impact stays unclear
The extent of unauthorized data extraction across the campaign has not been established. The named companies described different impacts and responses.
Deere said it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the intrusion affected a standalone website containing only product support information and that it had contained the threat.
Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” Two smaller businesses also acknowledged compromises.
Cairn’s author, who uses the social media handle le1xia0, said in a post on X that the platform was not designed for hacking attacks. “If it is used to carry out harmful hacking attacks, that is not my intention.”
The campaign adds to documented criminal use of agents. In August, Gambit Security found that Russian-speaking extortionists used Cursor AI to breach seven organizations. In September, it documented an agent-driven campaign that compromised 25 companies and stole at least 600,000 credit card records. Last week, Bitsight said discussions of autonomous agents were surging on cybercriminal forums.
Fagerland said he had previously expected hacking agents to require at least some supervision. After observing the autonomous AI hacking campaign, he said his assessment had changed: “The development in this field is astounding.”
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
Click Here For The Original Source.
——————————————————–
