The AI agents ran more than 1,100 break-in attempts in about three weeks, costing roughly $50 in AI fees for each successful attempt.
Reuters reported a Chinese-speaking hacker used AI agents to break into websites belonging to more than 100 companies, including farm equipment maker John Deere, home appliance company SharkNinja and engine manufacturer Cummins. The hacker gave the agents brief instructions, and they did almost all the work.
Cybersecurity company NorForge uncovered the campaign and published its research the same day. NorForge’s report does not name the victims. Reuters identified them by reviewing the hacker’s activity records.
The hacker spent a few thousand dollars on AI to break into companies as large as John Deere. Snorre Fagerland, NorForge’s principal threat researcher, told Reuters the campaign used about $5,000 worth of AI processing, or roughly $50 per successful break-in. He said the campaign was real-world evidence that commercially available AI agents can carry out complex break-ins from start to finish without a person stepping in.
The hacker set the targets, and the AI agents worked out how to break in
The hacker used Cairn, a free, open-source AI program. A user gives Cairn a target and a goal, and it directs AI agents to study the target, look for security weaknesses, and try to break in. Cairn’s author wrote on X that the program “was not designed for hacking attacks,” Reuters said.
Starting Sept. 25, the hacker ran more than 1,100 break-in attempts against shopping websites, mostly in the U.S., Canada, Japan, and Australia. The hacker’s software chose the targets automatically, ranking sites by traffic and first checking that each one could take orders. The hacker’s instructions were fewer than 100 Chinese characters long.
The goal of each attack was to plant a web shell, a hidden page on the company’s website that lets the attacker return later and upload files to the site’s server. NorForge estimates that about 10% of attempts succeeded. When an attack succeeded, it took a little under 23 hours on average from start to finish. One took more than five days.
In one case, the agents could not find a weakness in a large company’s main website. They found another of the company’s systems, a management page open to the internet, and after hours of trial and error found a flaw in how it handled data. The flaw let them run their own commands on the company’s server. “It’s not straightforward to come up with solutions like that,” Fagerland told Reuters.
The hacker’s panels labeled the agents “claudecode_deepseek-v4.1-flash.” NorForge said that suggests they used Claude Code, Anthropic’s AI coding software, connected to a low-cost AI model from Chinese company DeepSeek.
NorForge confirmed break-ins, and Deere, SharkNinja and Cummins say they acted or are investigating
When the hacker’s AI agents broke into a site, they recorded it in Cairn, along with the web shell’s address. NorForge visited some of those addresses to check that the break-ins were real. At a large hardware parts vendor, the web shell was still live on the company’s site. NorForge said the attacker could change it at any time into something more harmful. NorForge also confirmed a break-in at a very large U.S. retailer.
The named companies told Reuters:
- Deere said it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.”
- SharkNinja said the attack hit a separate website that carries only product support information, and that the threat had been contained.
- Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.”
Two smaller businesses also told Reuters they had been broken into. Reuters could not determine how much data the hacker took.
Criminals’ open control panels exposed victims’ passwords
The Chinese-speaking hacker was one of several criminals using Cairn. NorForge found them because they left their Cairn control panels open on the internet, with no password. Starting around Oct. 2, Fagerland searched for these panels and found more than 20 that NorForge judged likely to belong to criminals. All appeared to be after money.
The hacker ran 14 of those panels. Another group, writing in English, told its agents to steal credit card data and cryptocurrency, sometimes with no instruction beyond “fetch credit cards.”
The open panels also showed everything the agents had found on their targets, along with passwords the hackers had gathered elsewhere. NorForge scanned the panels and found hundreds of passwords and other login details. 11% of them still worked. The panels also displayed controls to start, stop, or redirect the agents. NorForge did not try them.
NorForge and Reuters notified victims, but the panels may stay online
NorForge said it worked with Reuters to notify victims, starting with those that appear to have been broken into. It is asking the companies that host the panels to take them down, and said some panels may stay online if those companies do not act.
In September, a hacker also used Cairn to break into at least 27 online retailers in six days, and stole more than 600,000 payment card records from two of them.
