A Chinese-speaking hacker was found to have assigned hacking tasks to artificial intelligence (AI) and broken into websites of more than 100 corporations. As AI can now find security vulnerabilities on its own and carry out complex cyberattacks, there are concerns that corporate information security could face an emergency.Illustration = ChatGPTAccording to Reuters on the 19th (local time), Snorre Fagerland, principal researcher at the cybersecurity firm NorForge, recently detected signs that a Chinese-speaking hacker used an AI agent to attack e-commerce websites in the United States, Canada, Australia and Japan. An AI agent is an AI system that, once a user sets a goal, plans and performs the necessary tasks on its own.Starting on the 25th of last month, the hacker used AI agents to attempt intrusions into more than 1,200 websites. Among them, websites of more than 100 corporations were breached. Targets included U.S. farm machinery maker Deere, home appliance maker SharkNinja, and engine maker Cummins.According to a report Fagerland provided to Reuters, the hacker did not do much directly. After the hacker described the desired intrusion method in a short instruction of fewer than 100 Chinese characters, the AI agent spent dozens of hours finding security vulnerabilities on websites and attempting attacks. It typically took about 23 hours to achieve a successful intrusion.The hacking was estimated to have used an AI model from China’s DeepSeek and Claude Code, an AI coding tool from U.S.-based Anthropic. Fagerland analyzed that about $5,000 (about 670,000 won) worth of AI tokens were consumed in this hacking campaign. That amounts to about $50 (about 67,000 won) per successfully breached website in expenditure.Fagerland discovered the hacking signs while investigating Cairn, an open-source AI platform exposed on the internet. Through this, it was possible to confirm the instructions the hacker gave the AI agent and the tasks the AI actually carried out.The AI agent did not stop at searching for known security vulnerabilities. When it failed to find a flaw in a major corporation’s public application (app), it analyzed related digital records and located an administrator screen accessible from outside. The AI agent then identified a weakness in the data processing flow and, after hours of attempts, got the server to execute malicious commands.”It is not a simple matter for AI to find such a solution,” Fagerland said, adding, “This is not the level of technique used by novice hackers.”Some corporations targeted by the hacking acknowledged the intrusions. Deere said it had taken necessary security measures and that there were no signs sensitive information had been accessed. SharkNinja explained that a separate website providing only product support information was attacked and that it has now blocked the threat. Cummins said it is investigating the possibility of a cyberattack on a website operated by an external partner. Two small and midsize businesses also acknowledged intrusion damage.However, a website intrusion does not necessarily mean customer information was leaked. Reuters said it could not confirm whether any data was actually exfiltrated in this hacking and, if so, to what extent.In particular, concerns are growing because even without specialized hacking skills, AI can be used to attack many corporations. With relatively low expense, AI can perform everything from vulnerability scanning to intrusion, potentially lowering the technical barrier needed for cyberattacks.Cyberattacks using AI have already been confirmed multiple times. Israel-based security firm Gambit Security said last month that 25 corporations were hacked in attacks using AI agents and that at least 600,000 credit card records were stolen. In August, Russian-speaking extortionists broke into seven organizations using AI tools. Cyber threat intelligence firm Bitsight also said last week that discussions on how to use autonomous AI agents are surging on online forums used by cybercriminals.※ This article has been translated by AI. Share your feedback here.
Click Here For The Original Source.
——————————————————–
