# Hacker's AI Agents Breached 100+ Company Websites for About $5,000

- URL: https://usa-24.com/ai-agents-hack-websites/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-10-20T04:25:54.753Z
- Updated: 2026-10-20T04:25:54.759Z
- Topics: AI Agents, Cybersecurity, Data Breaches, E-Commerce Security, Microsoft

> A single Chinese-speaking operator reportedly let open-source AI agents breach more than 100 company websites at roughly $50 per intrusion, according to a Reuters exclusive.

## Key takeaways

- A Reuters exclusive published October 19, 2026 reported that a single Chinese-speaking operator used open-source AI agents to breach more than 100 company websites.
- The campaign attempted more than 1,200 sites, mostly e-commerce stores in the United States, Canada, Australia and Japan, beginning September 25.
- Roughly $5,000 in AI token spend works out to about $50 per successful intrusion, and each intrusion took the agents about 23 hours.
- The agents ran on Cairn, an open-source platform whose exposed control panels NorForge found on the open web, with more than 20 linked to malicious activity.
- Microsoft announced same-day controls, including Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access, that can limit or stop an AI agent as its assessed risk rises.

A single Chinese-speaking operator reportedly let AI agents hack more than 100 company websites, including sites tied to John Deere, SharkNinja and Cummins, for roughly $5,000 in AI tokens. Reuters reported the details in an exclusive published Monday, October 19, and other outlets have summarized it since. The operator reportedly did very little of the hands-on work, which is what makes the case stand out.

Most of what follows comes from the Reuters report as summarized by other outlets, plus a security researcher's account of the activity. Where those accounts disagree, this article says so.

## How AI agents hacked websites starting September 25

According to [aiweekly](https://aiweekly.co/alerts/hackers-ai-agents-breached-100-sites-at-50-each-norforge-says), the campaign began September 25, and the agents attempted more than 1,200 sites, mostly e-commerce stores in the United States, Canada, Australia and Japan. The researcher who tracked much of the activity, Snorre Fagerland, is a principal threat researcher at the security firm NorForge. His team's timeline does not fully match the Reuters-based account. NorForge began finding exposed control panels around October 2, about a week after the campaign reportedly started.

The operator's instructions were short, under 100 Chinese characters according to reporting. They told the agents to find a way to run code on each site and plant an uploader web shell, a small file that lets an attacker push files to a server and run commands. Each successful intrusion took the agents roughly 23 hours.

Twenty-three hours is slow for a person at a keyboard. For software working in the background, it is simply a long job. Fagerland had expected that hacking agents would still need supervision. This campaign suggested otherwise.

## Inside Cairn, the open-source platform behind the agents

The campaign ran on Cairn, an open-source platform that coordinates AI agents. [Cybersecurity News](https://cybersecuritynews.com/chinese-hacker-use-ai-agent-to-hack/) describes Cairn as a general-purpose problem-solving engine rather than a hacking tool. The feature that matters here is its shared project board. It lets agents reuse earlier findings and try new paths when one fails, so a dead end on one site can inform the next attempt.

NorForge found more than 20 exposed Cairn control panels linked to malicious activity, plus a second, English-language cluster of 10 panels focused on stealing credit card and cryptocurrency data, as [Quartz](https://qz.com/ai-agents-hacker-john-deere-sharkninja-cummins-breach-101926) reported. A control panel that anyone can reach from the open web is a basic mistake, and it gives outsiders a view of the same tools the operator used.

Every task was executed by a worker labeled claudecode_deepseek-v4.1-flash. NorForge said the label might indicate a Claude Code harness driven by DeepSeek's V4.1 Flash model. That is a label, not proof, and no source has confirmed how the attacker's setup was built.

For security teams, the lesson is less about one platform than about design. A system built to reuse findings and retry failed paths is useful for legitimate testing and dangerous in the wrong hands, and the same features make both possible.

A separate federal action is a different story. [Federal civilian agencies were ordered to remove DeepSeek products](https://usa-24.com/deepseek-federal-ban-dhs-order/), but reporting on this campaign does not connect that order to the intrusions.

## Which companies were hit and what they said

Reuters named Deere, SharkNinja and Cummins as victims after reviewing the hacker's activity, according to [WinBuzzer](https://winbuzzer.com/2026/10/20/hacker-used-ai-agents-to-breach-100-plus-companies-websites-xcxwbn/). Their responses vary in scope.

Deere said it took remediation steps. A John Deere spokesperson told Reuters there was “no indication that sensitive information was accessed,” a statement Quartz carried.

SharkNinja said the attack reached a separate website that hosted product support details and that it had contained the threat.

Cummins said it was looking into a report that a website run by one of its third-party vendors may have been attacked. That detail points to a common weak spot. A company can be exposed through a partner's web tools even when its own site is well guarded.

Shoppers who bought from named or similar retailers may receive breach notices in the coming weeks, but the scope of any data theft is still unclear. [The Next Web](https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge) said it had not independently verified the intrusions, so the figures here should be read as reported rather than confirmed.

Mass scanning of e-commerce sites is common, as [Shattered](https://shattered.io/ai-agents-breached-100-firms-50-dollar-site-2026/) notes. The new element is how much of the intrusion work was handed to agents, which lowers the effort required for each additional target.

## What the $5,000 figure does and does not show

Roughly $5,000 in token spend across more than 100 successful intrusions works out to about $50 per intrusion. Another summary gives a different unit price, about $5 per task with a success rate near 10 percent. Those numbers are consistent. If one in ten tasks succeeds, each success still costs about $50. The math shows that failed attempts are cheap enough to absorb.

For a retailer, the relevant comparison is not the price of the tokens. It is the cost of a breach notice, a forensic review and lost customer trust.

Several basics remain open. Reuters could not establish how much data, if any, was taken. Some victims have not been publicly identified, and Cummins' vendor-site report is still under investigation. Reporting describes the activity as one operator, but the operator's identity is unknown.

## Microsoft's new controls for risky AI agents

Microsoft unveiled controls for enterprise AI agents the same day as the Reuters exclusive. According to [SiliconANGLE](https://siliconangle.com/2026/10/19/microsoft-targets-the-agentic-insider-with-new-controls-for-rogue-ai-agents/), the controls can limit or stop an agent as its assessed risk rises. [Security Boulevard](https://securityboulevard.com/2026/10/microsoft-introduces-new-controls-to-limit-ai-agent-privileges/) identifies the named features as Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access.

Microsoft also said its agent discovery now covers 60 types of locally running agents, after adding 35. In an October 19 post, Hayete Gallot described enterprise agents as “agentic insiders” in [Microsoft's security blog](https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/). Locally run models are getting easier to deploy, as a recent story on [Meta's Muse Spark Open running locally on Apple Mac Studios](https://usa-24.com/meta-muse-spark-open-mac-studio/) illustrates.

[TokenPost](https://www.tokenpost.com/news/technology/34968) reports that the new controls build on Project Perception, which Microsoft introduced in July to defend against AI-driven attacks. [Cybersecurity News](https://cybersecuritynews.com/ai-models-as-insider-threats/) frames the controls as a planned approach rather than a guarantee that agent threats can be prevented. Reporting does not link the announcement to the Reuters exclusive.

The Cairn case shows why the permission question matters. The agents kept reusing what they learned across sites. Security teams should check whether AI tools on their networks have more access than they need, which is the core idea behind Microsoft's controls.

## What shoppers and site owners should do now

These are general recommendations from USA 24, not guidance from Reuters or the named companies.

- Check card statements for charges you do not recognize, and call your issuer right away if you find one.
- Use a unique password for each retailer account, and turn on multifactor authentication.
- If you run a website, look for uploaded files you did not add, and keep admin panels off the public internet.
- If you manage AI agents, find any exposed control panels and cut each tool's permissions to the minimum it needs.

## What to watch next

Three things will show how large this campaign really was. Retailer breach notices should reveal whether customer data left the sites. Cummins' vendor investigation may confirm or rule out a compromise. And future security reporting should show whether agent controls like Microsoft's can stop an operator who needed fewer than 100 Chinese characters of instruction to start. The harder question is whether the next campaign will need a person at all.

## Frequently asked questions

### Which companies were hit by the AI agent hacking campaign?

Reuters named Deere, SharkNinja and Cummins as victims after reviewing the hacker's activity. Deere said it found no sign that sensitive information was accessed, SharkNinja said it contained the threat on a separate support site, and Cummins is looking into a report about a third-party vendor's website. The scope of any data theft remains unclear.

### What is Cairn, the platform used in the attack?

Cairn is an open-source platform that coordinates AI agents. Cybersecurity News describes it as a general-purpose problem-solving engine rather than a hacking tool. Its shared project board lets agents reuse earlier findings when one path fails, and NorForge found more than 20 exposed Cairn control panels tied to malicious activity.

### How much did the AI agent hacking campaign cost?

Reporting cites roughly $5,000 in AI token spend, or about $50 per successful intrusion. One summary gives a unit cost of about $5 per task with a success rate near 10 percent, which works out to the same roughly $50 per success. Each successful intrusion took about 23 hours.

### Should I worry if I bought from a retailer named in the reporting?

Shoppers who bought from named or similar retailers may receive breach notices in the coming weeks, according to reporting. Check your card statements for unfamiliar charges. Use a unique password and multifactor authentication on retailer accounts.

### What is Microsoft doing about risky AI agents?

Microsoft unveiled controls on October 19 that can limit or stop an AI agent as its assessed risk rises. The named features are Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. Cybersecurity News describes the approach as planned rather than a guarantee against agent threats.

## Sources

1. [Hacker's AI agents breached 100+ sites at $50 each, NorForge says](https://aiweekly.co/alerts/hackers-ai-agents-breached-100-sites-at-50-each-norforge-says)
2. [Hacker Leverages AI Agents to Breach More Than 100 Company Websites](https://winbuzzer.com/2026/10/20/hacker-used-ai-agents-to-breach-100-plus-companies-websites-xcxwbn/)
3. [Hacker's AI agents broke into 100+ sites, including John Deere and SharkNinja, Norforge says](https://qz.com/ai-agents-hacker-john-deere-sharkninja-cummins-breach-101926)
4. [AI agents broke into 100+ sites for one hacker at $50 each, researcher says](https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge)
5. [One Hacker Uses AI Agents to Breach Over 100 Company Websites for Just $5,000](https://cybersecuritynews.com/chinese-hacker-use-ai-agent-to-hack/)
6. [Agents are your newest insiders. Security must move at their speed.](https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/)
7. [Microsoft targets the 'agentic insider' with new controls for rogue AI agents](https://siliconangle.com/2026/10/19/microsoft-targets-the-agentic-insider-with-new-controls-for-rogue-ai-agents/)
8. [Microsoft Introduces New Controls to Limit AI Agent Privileges](https://securityboulevard.com/2026/10/microsoft-introduces-new-controls-to-limit-ai-agent-privileges/)
9. [Microsoft Calls for Continuous Security Oversight of Enterprise AI Agents](https://www.tokenpost.com/news/technology/34968)
10. [AI Agent Hacking Spree Breaches 100+ Firms [2026]](https://shattered.io/ai-agents-breached-100-firms-50-dollar-site-2026/)
11. [Microsoft Says AI Agents Cannot Be Trusted and Could Become Insider Security Threats](https://cybersecuritynews.com/ai-models-as-insider-threats/)