Hacker's AI Agents Breached 100+ Company Websites for About $5,000

A single Chinese-speaking operator reportedly let AI agents hack more than 100 company websites, including sites tied to John Deere, SharkNinja and Cummins, for roughly $5,000 in AI tokens. Reuters reported the details in an exclusive published Monday, October 19, and other outlets have summarized it since. The operator reportedly did very little of the hands-on work, which is what makes the case stand out.

Most of what follows comes from the Reuters report as summarized by other outlets, plus a security researcher's account of the activity. Where those accounts disagree, this article says so.

How AI agents hacked websites starting September 25

According to aiweekly, the campaign began September 25, and the agents attempted more than 1,200 sites, mostly e-commerce stores in the United States, Canada, Australia and Japan. The researcher who tracked much of the activity, Snorre Fagerland, is a principal threat researcher at the security firm NorForge. His team's timeline does not fully match the Reuters-based account. NorForge began finding exposed control panels around October 2, about a week after the campaign reportedly started.

The operator's instructions were short, under 100 Chinese characters according to reporting. They told the agents to find a way to run code on each site and plant an uploader web shell, a small file that lets an attacker push files to a server and run commands. Each successful intrusion took the agents roughly 23 hours.

Twenty-three hours is slow for a person at a keyboard. For software working in the background, it is simply a long job. Fagerland had expected that hacking agents would still need supervision. This campaign suggested otherwise.

Inside Cairn, the open-source platform behind the agents

The campaign ran on Cairn, an open-source platform that coordinates AI agents. Cybersecurity News describes Cairn as a general-purpose problem-solving engine rather than a hacking tool. The feature that matters here is its shared project board. It lets agents reuse earlier findings and try new paths when one fails, so a dead end on one site can inform the next attempt.

NorForge found more than 20 exposed Cairn control panels linked to malicious activity, plus a second, English-language cluster of 10 panels focused on stealing credit card and cryptocurrency data, as Quartz reported. A control panel that anyone can reach from the open web is a basic mistake, and it gives outsiders a view of the same tools the operator used.

Every task was executed by a worker labeled claudecode_deepseek-v4.1-flash. NorForge said the label might indicate a Claude Code harness driven by DeepSeek's V4.1 Flash model. That is a label, not proof, and no source has confirmed how the attacker's setup was built.

For security teams, the lesson is less about one platform than about design. A system built to reuse findings and retry failed paths is useful for legitimate testing and dangerous in the wrong hands, and the same features make both possible.

A separate federal action is a different story. Federal civilian agencies were ordered to remove DeepSeek products, but reporting on this campaign does not connect that order to the intrusions.

Which companies were hit and what they said

Reuters named Deere, SharkNinja and Cummins as victims after reviewing the hacker's activity, according to WinBuzzer. Their responses vary in scope.

Deere said it took remediation steps. A John Deere spokesperson told Reuters there was “no indication that sensitive information was accessed,” a statement Quartz carried.

SharkNinja said the attack reached a separate website that hosted product support details and that it had contained the threat.

Cummins said it was looking into a report that a website run by one of its third-party vendors may have been attacked. That detail points to a common weak spot. A company can be exposed through a partner's web tools even when its own site is well guarded.

Shoppers who bought from named or similar retailers may receive breach notices in the coming weeks, but the scope of any data theft is still unclear. The Next Web said it had not independently verified the intrusions, so the figures here should be read as reported rather than confirmed.

Mass scanning of e-commerce sites is common, as Shattered notes. The new element is how much of the intrusion work was handed to agents, which lowers the effort required for each additional target.

What the $5,000 figure does and does not show

Roughly $5,000 in token spend across more than 100 successful intrusions works out to about $50 per intrusion. Another summary gives a different unit price, about $5 per task with a success rate near 10 percent. Those numbers are consistent. If one in ten tasks succeeds, each success still costs about $50. The math shows that failed attempts are cheap enough to absorb.

For a retailer, the relevant comparison is not the price of the tokens. It is the cost of a breach notice, a forensic review and lost customer trust.

Several basics remain open. Reuters could not establish how much data, if any, was taken. Some victims have not been publicly identified, and Cummins' vendor-site report is still under investigation. Reporting describes the activity as one operator, but the operator's identity is unknown.

Microsoft's new controls for risky AI agents

Microsoft unveiled controls for enterprise AI agents the same day as the Reuters exclusive. According to SiliconANGLE, the controls can limit or stop an agent as its assessed risk rises. Security Boulevard identifies the named features as Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access.

Microsoft also said its agent discovery now covers 60 types of locally running agents, after adding 35. In an October 19 post, Hayete Gallot described enterprise agents as “agentic insiders” in Microsoft's security blog. Locally run models are getting easier to deploy, as a recent story on Meta's Muse Spark Open running locally on Apple Mac Studios illustrates.

TokenPost reports that the new controls build on Project Perception, which Microsoft introduced in July to defend against AI-driven attacks. Cybersecurity News frames the controls as a planned approach rather than a guarantee that agent threats can be prevented. Reporting does not link the announcement to the Reuters exclusive.

The Cairn case shows why the permission question matters. The agents kept reusing what they learned across sites. Security teams should check whether AI tools on their networks have more access than they need, which is the core idea behind Microsoft's controls.

What shoppers and site owners should do now

These are general recommendations from USA 24, not guidance from Reuters or the named companies.

• Check card statements for charges you do not recognize, and call your issuer right away if you find one.
• Use a unique password for each retailer account, and turn on multifactor authentication.
• If you run a website, look for uploaded files you did not add, and keep admin panels off the public internet.
• If you manage AI agents, find any exposed control panels and cut each tool's permissions to the minimum it needs.

What to watch next

Three things will show how large this campaign really was. Retailer breach notices should reveal whether customer data left the sites. Cummins' vendor investigation may confirm or rule out a compromise. And future security reporting should show whether agent controls like Microsoft's can stop an operator who needed fewer than 100 Chinese characters of instruction to start. The harder question is whether the next campaign will need a person at all.