Researchers Say One Hacker's AI Agents Reached Websites of About 100 Companies for Roughly $5,000 in Tokens

A hacker set autonomous AI agents loose on more than 1,200 websites and let them do the breaking in. The agents got into roughly 100 companies' sites, including farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins. That is the finding of Snorre Fagerland, principal threat researcher at the cybersecurity firm NorForge, in a report published Monday, Oct. 19.

Reuters, which saw the report before publication, identified the victims by reviewing the attacker's own records. Reuters reported that the campaign began Sept. 25 and cost about $5,000 in tokens from DeepSeek and Anthropic's Claude Code models, according to researchers. Divide that by the number of breaches and you get roughly $50 each.

How the operation was found

Fagerland was scanning the internet for exposed copies of Cairn, an open-source AI platform popular with hackers. Starting around Oct. 2, he found about two dozen instances being used maliciously. Their control panels were open to the public, so he could watch the work in real time.

Cairn gives AI agents a starting point and a goal, then lets them work toward it step by step. The agents post findings to a shared board, and the human operator can add hints.

NorForge sorted the exposed panels into three clusters and judged more than 20 likely malicious. The busiest, which it calls AIA0001, is Chinese-language and ties 14 panels to more than 1,100 attack projects. NorForge said the apparent aim is lasting access to shop and payment systems, with targets in the United States, Japan and Australia.

A typical task told the agents to find a way to run code on a shop, then plant a web shell uploader. That is a form that saves uploaded files rather than running commands, and attackers can swap it for something worse at any time.

NorForge checked one claimed break-in at a large hardware-parts vendor and found the web shell live. It also independently confirmed the compromise of one very large U.S. retailer, where the agents found the single cookie setting that selected a vulnerable backend server.

What the victims say

Deere told Reuters it took steps to fix the problem and had no sign sensitive information was accessed. SharkNinja said the attack hit a standalone product-support site and that it had contained the threat. Cummins said it was investigating a report of a possible attack on a website run by one of its vendors. Two smaller businesses also told Reuters they were compromised.

How much data, if any, was stolen has not been established.

Cairn's author, who posts as "le1xia0," told Reuters the tool was not designed for hacking attacks and that harmful use was not their intention. It was built for authorized penetration testing, among other jobs.

Not an isolated case

CrowdStrike found that a separate operator breached several South Korean financial institutions from late September to early October using ARTEX, an open-source agentic pentesting tool built in China. According to security firm Flare's account of that finding, the instance used DeepSeek v4.1-flash as its primary model, with GLM-5.3 and Grok 4.6 supplementing Claude Code sessions.

At least nine South Korean banks were disclosed or reported as targets. Shinhan Bank said data on about 25,000 customers was exposed through a service loan brokers use to check applications. Police opened an investigation, and President Lee Jae Myung called for a strong response. CrowdStrike assesses with moderate confidence that the operator is a Chinese-speaking, financially motivated individual and has not tied the activity to a named adversary.

The Israeli firm Gambit Security found that Russian-speaking extortionists used the Cursor AI tool to break into seven organizations in August. In September it documented an AI-agent-driven spree that breached 25 companies and stole at least 600,000 credit card records. Bitsight said last week that discussion of autonomous agents is surging on cybercriminal forums.

Why the economics changed

Jessica Ji, a senior research analyst at Georgetown's Center for Security and Emerging Technology, told Fortune the tools have "gotten meaningfully better" over the past year. Coding skills improved, and the models became more agentic, meaning they can operate other software instead of just producing text. "These AI systems are now both more capable of hacking and are able to act more autonomously," she said.

Varun Chandrasekaran, an assistant professor of electrical and computer engineering at the University of Illinois, said agents can run around the clock at a "fraction of the cost of human attackers." That "fundamentally changes the economics of exploitation," he said.

The damage is also showing up in insurance claims. Christine Mapes of Travelers said at the NetDiligence Cyber Risk Summit that financial fraud and business email compromise make up about 50% of the insurer's cyber claims. Travelers saw a 57% jump in the frequency of those claims from the first half of 2025 to the first half of 2026, she said, and claim severity is up about 30% since 2023.

The open-weight fight

Ji said attackers are "not restricted to the most capable 'closed' models and can use similarly-capable open models that are potentially more difficult to set up, but less expensive." Anthropic CEO Dario Amodei has warned that open models pose a risk of widespread and potentially devastating cyberattacks. He and others have said government restrictions on distributing and using them may be needed.

Others argue the opposite: that open models help defenders more than attackers. Their example is Hugging Face, which found itself under autonomous attack by an agent in July. It first tried a closed model to defend itself, but that model refused the request because of its security guardrails. The company then switched to an open model.

Both sides have a point they can document. The Korean bank intrusions leaned heavily on open-weight and Chinese-built tools. This latest campaign mixed DeepSeek with a closed Anthropic product. Restrictions on one category would not have covered both.

The near-term fixes are less glamorous. Lindsay Nickle, vice chair of the cyber team at the law firm Constangy, told the NetDiligence summit the industry needs low-tech verification processes, the way it learned to handle social engineering five or six years ago.

The open question is the one the victims have not answered. Cummins is still investigating, Deere says it found no sign sensitive data was accessed, and no company has said what, if anything, left its systems.