A single hacker, working with off-the-shelf AI agents and roughly $5,000 in token spending, broke into websites belonging to more than 100 companies across four countries, according to a Reuters exclusive published October 19, 2026. The campaign ran for weeks, targeted over 1,200 e-commerce sites, and reportedly succeeded against household names including Deere, SharkNinja and Cummins. Security researchers say the operation is one of the clearest signs yet that agentic AI has collapsed the cost and skill barrier that once separated casual intruders from capable ones.What Happened: Inside the Cairn Exploit CampaignWho Is Behind the AttacksThe Numbers Behind a $5,000 Hacking SpreeDeere, SharkNinja and Cummins: The Named VictimsInside Cairn: The Open-Source AI Platform Under FireHow DeepSeek and Claude Code Became an Attacker’s ToolkitConfirmed vs. Unconfirmed: Separating Fact From SpeculationWhy Agentic AI Is Lowering the Bar for CybercrimeMarket Impact: E-Commerce Security Budgets Face New PressureHistorical Context: From Script Kiddies to Agentic HackersAI-Assisted Intrusions vs. Traditional Penetration TestingWhat Companies Running AI Agent Platforms Should Do NowPredictions: Where Agentic AI Hacking Goes From HereRelatedFrequently Asked QuestionsWhat is Cairn, the platform at the center of the hack?How did one hacker breach more than 100 companies?Which companies were named in the breach?How much did the hacking campaign cost?Which AI tools did the hacker use?Is the hacker’s identity known?What should companies running AI agent platforms do to protect themselves?How is this different from traditional hacking?Related Coverage
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Inside the Cairn Exploit Campaign
The campaign traces back to September 25, 2026, when the attacker began systematically probing e-commerce websites in the United States, Canada, Australia and Japan, according to Reuters. Over the following weeks, the operator attempted to break into more than 1,200 sites and succeeded against more than 100 companies, a hit rate that would have been difficult for a single person to achieve manually at that scale and speed. The common thread across the targets was exposure through Cairn, an open-source AI problem-solving platform that the attacker appears to have weaponized rather than exploited through a traditional software bug.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
What makes the campaign notable is not the number of victims alone, but how little effort the intrusion required from the person directing it. Reuters reported that the instructions fed to the AI agents driving the attack were fewer than 100 Chinese characters, essentially a short directive rather than detailed exploit code. The AI agents did the rest: scanning, probing, and testing each target for weaknesses over an average of roughly 23 hours before a successful break-in.
Who Is Behind the Attacks
The person or group responsible has been described only as Chinese-speaking, based on the language used in the instructions sent to the AI agents. No personal identity, location, or organizational affiliation has been confirmed in reporting so far. That ambiguity is itself part of the story: a campaign that touched more than 100 companies across four continents-spanning countries left investigators with a linguistic clue but not a name.
Researchers have been careful not to overstate what is known. There is no confirmed evidence yet of a specific individual’s identity, no confirmed headcount for the operation beyond “a hacker,” and no verified detail on what, if anything, was done with data taken from the breached sites. That restraint matters, because campaigns like this one tend to attract speculation faster than facts can catch up, and premature attribution has burned investigators before.
The Numbers Behind a $5,000 Hacking Spree
The figures at the center of this story are what made it spread so quickly. Snorre Fagerland, principal threat researcher at NorForge, found about two dozen exposed instances of Cairn while investigating the campaign and estimated that the entire operation consumed roughly $5,000 worth of AI tokens, or about $50 per successful breach, according to a CTV News report on the Reuters exclusive. For context, that is less than the cost of a single consulting hour at most commercial penetration testing firms, spent instead on compute time for AI agents working largely unsupervised.
MetricDetail
Campaign start dateSeptember 25, 2026
Report publishedOctober 19, 2026 (Reuters)
Total sites targetedMore than 1,200
Companies successfully breachedMore than 100
Countries targetedUnited States, Canada, Australia, Japan
Named victimsDeere, SharkNinja, Cummins
Exploited platformCairn (open-source AI problem-solving platform)
Exposed Cairn instances found by researcherAbout two dozen
AI tools used by the attackerMixture of DeepSeek and Claude Code
Length of attacker’s instructionsFewer than 100 Chinese characters
Average time to successful breachAbout 23 hours
Estimated total campaign spendRoughly $5,000 in AI tokens
Estimated cost per successful breachAbout $50
Researcher who identified the campaignSnorre Fagerland, NorForge
Those numbers reframe how cheap large-scale intrusion attempts have become once AI agents are doing the repetitive reconnaissance work. A 23-hour average dwell time per successful breach sounds slow next to a skilled human operator working a single target, but it is remarkably fast when multiplied across more than 1,200 attempted sites run with minimal human oversight.
Deere, SharkNinja and Cummins: The Named Victims
Among the more than 100 companies the hacker reportedly broke into, The Verge’s coverage of the campaign highlighted three names that stand out because they are large, publicly recognizable industrial and consumer brands: Deere, SharkNinja and Cummins. Their presence on the list underscores that this was not a campaign limited to small, under-resourced online shops. It reached companies with sizable IT budgets and, presumably, security teams of their own.
Reporting has not detailed what data, if any, was accessed at each of these companies, nor has it confirmed how each organization has responded. What is established is that these three names were specifically identified in the Reuters reporting as being among the breached parties, out of a victim pool that otherwise remains largely unnamed. That gap, over 100 affected companies but only three named, is itself a reflection of how disclosure around AI-enabled breaches is still catching up to the scale of the problem.
Inside Cairn: The Open-Source AI Platform Under Fire
Cairn, described in reporting as an open-source AI problem-solving platform, sits at the center of the campaign. The tool itself was not necessarily compromised through a flaw in its code; rather, instances of it appear to have been exposed to the public internet, giving an outside operator a path to misuse the AI capability the platform was built to provide. Fagerland’s discovery of roughly two dozen exposed instances suggests this was not a one-off configuration mistake at a single company, but a pattern repeated across many organizations that deployed Cairn without adequately restricting access to it.
The broader lesson security teams are drawing from this is familiar in shape, even if the tooling is new: an exposed management interface or API endpoint, once discoverable, becomes an open door regardless of how sophisticated the software behind it is. For illustration only, the kind of exposure researchers describe typically looks like an unauthenticated endpoint quietly reachable from the open internet, something like the pattern below, where no credential check gates access to a capability that should never be public:
# Illustrative example only - not actual exploit code
GET /api/v1/agent/status HTTP/1.1
Host: exposed-instance.example.com
HTTP/1.1 200 OK
Content-Type: application/json
{"status": "running", "auth_required": false}
That kind of unauthenticated response, when a management or agent endpoint should require a login, is exactly the sort of basic misconfiguration that threat researchers like Fagerland look for when sweeping the internet for exposed AI deployments. The growing body of research into how often AI-written and AI-deployed code skips basic security hardening suggests this is not an isolated incident, but part of a wider pattern as companies rush to stand up AI agent infrastructure faster than they lock it down.
How DeepSeek and Claude Code Became an Attacker’s Toolkit
According to Reuters, the operation appeared to use a mixture of DeepSeek and Claude Code to carry out its reconnaissance and intrusion attempts. Both are legitimate, widely used AI tools: DeepSeek is a Chinese AI lab’s model family that has drawn global attention for its low-cost, high-capability releases, and Claude Code is Anthropic’s agentic coding tool built to let developers delegate multi-step software tasks to an AI agent. Neither tool is inherently malicious, but both are capable enough at code generation, debugging, and iterative problem-solving that a motivated operator can redirect those same capabilities toward probing a target’s defenses instead of building a feature.
That dual-use reality is becoming one of the defining tensions in AI safety discussions. Anthropic has continued shipping agentic developer tools, including its recently formalized Claude Code plugin ecosystem, while DeepSeek has kept pushing free, permissively licensed releases like its MIT-licensed V4.1-Flash update into wide circulation. Both moves are good for legitimate developers and bad, in a different sense, for defenders who now have to assume that attackers have access to the same class of tooling, at the same low price, with none of the usage restrictions a closed enterprise product might impose.
Confirmed vs. Unconfirmed: Separating Fact From Speculation
Because a story like this travels fast, it is worth being explicit about where verified reporting ends and speculation begins. The table below separates what Reuters and the researcher have confirmed from what remains undetermined as of October 19, 2026.
ClaimStatusDetail
Hacker’s real identity, location and affiliationUnconfirmedDescribed only as Chinese-speaking based on instruction language
Exact number of successful intrusionsPartially confirmedReported as “more than 100 companies,” no precise total given
Whether one person or a group ran the campaignUnconfirmedReporting refers to “a hacker,” without clarifying team size
Theft or sale of payment card dataUnconfirmedNot established in available reporting
Named victim companiesConfirmedDeere, SharkNinja and Cummins specifically identified
AI tools used in the campaignConfirmedMixture of DeepSeek and Claude Code, per Reuters
Total estimated campaign spendConfirmed (researcher estimate)Roughly $5,000 in tokens, per Snorre Fagerland
This distinction matters because the loudest version of any breach story tends to outrun the documented one. No court has convicted anyone in connection with this campaign, no agency has named a suspect, and no figure beyond the researcher’s own estimate has been offered for the total financial damage. Aggregated coverage of the story, including a summary from Ground News pulling together outlets reporting on the campaign, shows the same core facts repeated without additional confirmed detail. Readers should treat anything beyond the table above as unverified until follow-up reporting fills in the gaps.
Why Agentic AI Is Lowering the Bar for Cybercrime
The central shift this campaign illustrates is not a new vulnerability class, it is a new economics of attack. Traditionally, breaching more than 100 organizations required either a large team, a botnet of compromised infrastructure, or considerable individual skill sustained over a long campaign. Here, a single operator supplied short natural-language instructions and let AI agents handle the iterative work of scanning, testing, and exploiting exposed systems, at a cost of about $50 per successful breach.
That cost structure changes who can realistically run a multi-target campaign. Where sustained reconnaissance against more than 1,200 sites once demanded either automation infrastructure that only well-funded groups could build, or enough manual hours that most individuals would give up, agentic AI tools now absorb that labor for the price of a few thousand dollars in API usage. Combined with ransomware operations that, according to industry tracking, have already surged 53% year over year, the Cairn campaign reads less like an isolated incident and more like a preview of a lower floor for large-scale intrusion attempts.
Market Impact: E-Commerce Security Budgets Face New Pressure
For e-commerce operators specifically, the targeting pattern in this campaign, more than 1,200 attempted intrusions concentrated on online retail infrastructure across the US, Canada, Australia and Japan, is a direct signal that automated, AI-assisted scanning is now a standing threat rather than a theoretical one. Security budgets at mid-sized e-commerce companies have historically lagged behind those of large enterprises, on the assumption that smaller operations are less attractive targets. A campaign that can probe 1,200 sites for roughly the token cost of a few thousand dollars erodes that assumption, because scale no longer requires proportional investment from the attacker’s side.
The breach also lands amid a broader pattern of infrastructure providers absorbing fallout from third-party compromises. Managed service and backend providers have already faced scrutiny this year after incidents like the ConnectWise cloud backup breach affecting 173 tenants, where a single vendor-side weakness cascaded across many downstream customers. The Cairn campaign follows a similar logic in reverse: instead of one vendor breach rippling outward, one exposed AI platform pattern was found and exploited repeatedly across more than 100 unrelated companies that happened to share the same misconfiguration.
Historical Context: From Script Kiddies to Agentic Hackers
The term “script kiddie” entered security vocabulary in the 1990s to describe low-skill attackers running pre-written exploit tools they did not fully understand. That era’s attacks were cheap but limited, because the tools themselves, however automated, still required the operator to find, configure, and chain them manually. Botnets in the 2000s and 2010s raised the scale ceiling further by automating infection and command-and-control, but still relied on malware code written and maintained by someone with real technical skill.
What the Cairn campaign represents is a further compression of that skill requirement. Rather than running pre-built tools or malware, the operator reportedly issued a short natural-language instruction, under 100 Chinese characters, and let general-purpose AI agents reason through the rest: finding targets, probing for exposure, and iterating on failed attempts. That is a meaningfully different skill floor than any prior era of mass intrusion, and it arrives at the same moment nation-state-linked groups are also experimenting with AI tooling, as seen in incidents like the BeyondTrust zero-day exploitation blamed on China-linked actors earlier this year.
AI-Assisted Intrusions vs. Traditional Penetration Testing
It is worth drawing a clear line between what this hacker did and what a legitimate penetration tester does, because the technical steps can look superficially similar. A sanctioned penetration test is scoped, authorized in writing, time-boxed, and reported back to the client with remediation guidance. The Cairn campaign had none of those characteristics: no authorization, no scoping agreement, and no indication that any of the more than 100 affected companies invited the probing that found their way into Reuters’ reporting.
The more interesting comparison is operational. A commercial penetration testing engagement against a single mid-sized target commonly runs into the thousands of dollars in consulting fees and takes days to weeks of scheduled human effort. This campaign spent an estimated $50 per successful breach and averaged roughly 23 hours of unattended AI-driven probing per target, applied simultaneously across more than 1,200 attempted sites. The gap between those two models, sanctioned and slow versus unsanctioned and cheap at scale, is exactly the gap that security teams now have to defend against, regardless of which side their own vendor relationships sit on.
What Companies Running AI Agent Platforms Should Do Now
The most immediate, concrete lesson from this campaign is narrow but urgent: any organization running Cairn, or a similar open-source AI problem-solving platform, should audit whether that instance is reachable from the public internet without authentication. Fagerland’s discovery of roughly two dozen exposed instances during his own research suggests this is not a rare misstep, and the pattern likely extends beyond Cairn to other self-hosted agentic AI tools that were deployed quickly without the same access controls applied to traditional internal systems.
More broadly, security teams should treat AI agent deployments, whether used internally for coding, customer support, or operations, with the same exposure discipline applied to databases and admin panels: authentication by default, network segmentation away from the public internet, and logging sufficient to detect the kind of sustained, automated probing that defined this campaign. A platform built to automate problem-solving is, by design, also a platform that can automate attacks if it falls into the wrong hands.
Predictions: Where Agentic AI Hacking Goes From Here
More exposed-instance campaigns targeting other self-hosted AI agent platforms are likely to surface in the coming months, following the same pattern Fagerland identified with Cairn.
Expect security vendors to market “AI agent exposure scanning” as a distinct product category, treating it the way cloud misconfiguration scanning emerged after early cloud storage leaks.
Regulators and insurers will likely start asking companies directly whether they run self-hosted AI agent infrastructure, adding it to breach-readiness questionnaires alongside existing cloud and network inventory questions.
The $50-per-breach economics documented in this campaign will probably be cited repeatedly in industry discussions as a benchmark for how cheap AI-assisted intrusion has become, independent of whether the exact figure is replicated elsewhere.
Attribution will likely remain difficult in similar cases, since short natural-language instructions leave far less forensic trail than custom malware code, making “Chinese-speaking, unidentified” the kind of attribution outcome defenders should expect to see again.
Related
Frequently Asked Questions
What is Cairn, the platform at the center of the hack?
Cairn is described in reporting as an open-source AI problem-solving platform. The campaign exploited instances of Cairn that were exposed to the public internet rather than a confirmed flaw in the software’s code itself.
How did one hacker breach more than 100 companies?
According to Reuters, the attacker gave AI agents short instructions, fewer than 100 Chinese characters, and let a mixture of DeepSeek and Claude Code handle the scanning, probing and exploitation across more than 1,200 targeted sites, averaging about 23 hours per successful breach.
Which companies were named in the breach?
Reuters named Deere, SharkNinja and Cummins among the more than 100 companies the hacker broke into. The identities of the remaining affected companies have not been publicly disclosed.
How much did the hacking campaign cost?
Snorre Fagerland of NorForge estimated the entire campaign consumed roughly $5,000 worth of AI tokens, which works out to about $50 for each successful breach.
Which AI tools did the hacker use?
Reuters reported the operation appeared to use a mixture of DeepSeek and Claude Code, both legitimate AI tools redirected toward unauthorized reconnaissance and intrusion.
Is the hacker’s identity known?
No. The attacker has been described only as Chinese-speaking, based on the language of the instructions given to the AI agents. No personal identity, location, or affiliation has been confirmed.
What should companies running AI agent platforms do to protect themselves?
Security teams should audit whether self-hosted AI agent platforms like Cairn are reachable from the public internet without authentication, apply the same network segmentation used for databases and admin panels, and log activity closely enough to catch sustained automated probing.
How is this different from traditional hacking?
Traditional large-scale intrusion campaigns typically required either a team, custom malware, or significant sustained individual effort. This campaign reportedly required only a short natural-language instruction and AI agents capable of handling the iterative technical work, at an estimated cost of about $50 per successful breach.
Related Coverage
Marcus ChenGaming & Consumer Tech EditorMarcus Chen is a senior editor at Tech Insider, where he leads coverage of the US online gaming market, including sweepstakes and social casinos, alongside consumer technology. He evaluates operators on their published terms, licensing and RNG certifications, stated redemption policies, and corroborating independent reporting, and writes plainly about what the evidence supports. Tech Insider does not run first-party money tests and does not gamble with reader funds. Marcus has reported on the technology and online-gaming industries for more than a decade.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
Click Here For The Original Source.
——————————————————–
