Hacker used AI to breach sites at more than 100 companies, Reuters finds

A Chinese-speaking hacker delegated nearly an entire intrusion campaign to AI agents, reaching websites belonging to more than 100 companies, Reuters reported on October 19. The agents attempted attacks against more than 1,200 sites. A researcher estimated roughly $5,000 in AI usage costs, though the extent of any data theft remains unclear.

The investigation draws on an unusual vantage point: the attacker’s own exposed software. Snorre Fagerland, principal threat researcher at cybersecurity company NorForge, found unsecured instances of Cairn, an open-source AI problem-solving platform. Those interfaces let him watch agents probe targets and pursue break-ins over the past couple of weeks.

Beginning September 25, the hacker targeted e-commerce websites in the United States, Canada, Australia and Japan. Instructions describing preferred intrusion tactics ran to fewer than 100 Chinese characters. Fagerland said the agents then spent hours working autonomously, with successful intrusions typically taking about 23 hours.

Cairn organizes work around a starting point and a goal. Agents record discoveries and intended next steps on a shared project board; a human can add hints there too. That structure lets multiple workers use what others have learned, rather than treating each attempt as an isolated exchange, NorForge explained in its investigation.

In one intrusion described to Reuters, agents found no weakness in a company’s public application. They searched digital records for related infrastructure and located an exposed control panel. After hours of trial and error, they reported exploiting a flaw in how it processed data to make the server execute malicious commands.

Roughly $5,000Campaign token cost

Fagerland’s estimate covers AI tokens, not a verified total operating budget.

About $50Token cost per successful intrusion

Fagerland estimated about $50 in token costs per successful hack.

The model setup is less certain than the activity visible in the panels. Fagerland told Reuters the campaign appeared to combine DeepSeek and Anthropic’s Claude Code. NorForge’s published analysis offers a narrower clue: a worker name suggested Claude Code was serving as the agent framework, with a DeepSeek model underneath.

NorForge said it did not have actual token-usage figures. Its cost calculations depended on assumptions about model pricing, cached tokens and when requests ran. It warned that the uncertainty was considerable. The dollar figures are therefore estimates of AI consumption, not measured spending or a complete accounting of the campaign’s costs.

Reuters independently reviewed the hacker’s Cairn activity to identify affected companies, which Fagerland’s report had not named. They included Deere, SharkNinja and Cummins. But Reuters could not determine the degree of unauthorized data extraction, and the companies described different levels of exposure:

• Deere said it had taken remediation actions and had no indication that sensitive information was accessed.
• SharkNinja said the intrusion affected a standalone product-support website and that the threat had been contained.
• Cummins said it was investigating a potential attack on a website operated by a third-party vendor.

The exposed interfaces also created another route to sensitive information. NorForge said panels could disclose target identities, discovered weaknesses, account secrets, API keys and compromise status. It redacted extracted data and withheld panel addresses. Cairn’s author, meanwhile, said in an X post cited by Reuters that the platform was not designed for hacking attacks and that harmful use was not their intention.