A Chinese-speaking attacker used autonomous AI agents to break into websites linked to more than 100 companies, according to research by Snorre Fagerland of NorForge reported by Reuters on 19 October 2026. Reuters identified Deere, SharkNinja, and Cummins among the companies affected and independently verified the activity.
What happened
- From 25 September, the agents probed more than 1,200 websites, aimed mainly at e-commerce sites in the US, Canada, Australia, and Japan.
- The attacker ran the campaign on Cairn, an open-source platform for coordinating AI agents, with instructions of fewer than 100 Chinese characters. The research was possible because the control panel had been left open on the internet.
- A successful intrusion typically took about 23 hours of automated probing.
- The researcher estimates the whole operation cost about $5,000 in AI usage, roughly $50 per successful break-in, though this is an estimate.
Why it mattered
It is one of the clearest public examples of one person using AI agents to run a hacking campaign at a scale that would once have needed a team, a week after Microsoft reported a state-aligned group using AI agents in the ConnectWise attacks.
Lessons for organisations
Automated attackers do not get bored, so the basics matter more: patch public websites quickly, remove old test pages and unused admin interfaces, and watch for sustained automated probing rather than single events.
Source: Reuters via RTÉ
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
