A single Chinese-speaking hacker pointed a team of AI agents at more than 1,200 websites and broke into the sites of more than 100 companies, including farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins, Reuters reported on Monday. The researcher who watched it happen, Snorre Fagerland, principal threat researcher at NorForge, estimated that the whole campaign cost roughly $5,000 in AI tokens, or about $50 per successful hack.
The human, by Reuters' account, did almost none of the work.
How the researcher saw it
Fagerland found the campaign by scanning the internet for exposed control panels of Cairn, an open-source AI problem-solving platform. In NorForge's report, published October 19, he says more than 20 exposed Cairn panels appeared to be tied to malicious activity, and that the panels appear completely unprotected. Anyone who found them could read the attackers' targets, instructions and results.
NorForge groups the activity into clusters. The most active, which it calls AIA0001, writes in Chinese and ran over 1,100 attack projects across 14 panels, mostly against sites in the US, Japan and Australia. The report says the goal appeared to be persistent access to e-commerce and payment systems for later monetization. Reuters says the Chinese-speaking hacker, the most prolific of those Fagerland observed, began on September 25 and had attempted more than 1,200 sites as of late last week, across US, Canadian, Australian and Japanese e-commerce sites. Reuters does not use NorForge's cluster labels.
NorForge's report does not name victims. Reuters says it identified Deere, SharkNinja and Cummins by independently reviewing the hacker's Cairn activity.
How the agents were used
Cairn, as NorForge describes it, is a general, step-by-step problem-solving engine that can be used for penetration testing. Each task is a project with a starting point and a goal. Agents record what they discover as "facts" on a shared blackboard, decide on a next step, and repeat until they reach the goal or stall. Cairn's author, who uses the handle "le1xia0", said in a recent post on X that the platform "was not designed for hacking attacks," according to Reuters.
The operator's instructions were short. Reuters says the hacker described the preferred intrusion tactics in fewer than 100 Chinese characters. A typical task translated in the NorForge report lists target sites in four countries with 200,000 to 1.5 million in traffic, asks for unauthenticated remote code execution, ranks techniques such as login SQL injection and file uploads, and defines success as an uploader shell on the server.
The pipeline feeding those tasks was also automated. According to NorForge, target sites were ranked by traffic and checked with Playwright, a browser automation tool, to confirm orders could be placed before being handed to the agents. Every task NorForge saw ran on a worker named "claudecode_deepseek-v4.1-flash", which the report says could mean a Claude Code harness running DeepSeek's V4.1 Flash model. Reuters describes the campaign as appearing to use a mix of DeepSeek and Anthropic's Claude Code.
Successful intrusions typically took around 23 hours of probing, according to Reuters. NorForge puts the average time from project start to goal at a little under 23 hours, with about 140 facts generated per project. Across the harnesses it observed, NorForge estimates an average success rate of around 10%.
Some of the work went beyond routine scanning. In one case described to Reuters, after failing to find a weakness in a large company's public application, the agents searched records for related infrastructure, found a public control panel, identified a subtle flaw in how it processed data, and after hours of trial and error reported using it to run commands on the server. "It's not script kiddie stuff," Fagerland told Reuters.
What the companies said
Reuters could not determine how much data, if any, was taken. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site carrying only product support information and that the threat was contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses also acknowledged being compromised, Reuters reported.
Why it matters
The cost is the headline. NorForge says it has no actual token counts and calls its estimate a guess with considerable uncertainty: around $5 per task on average, including failed attempts, with some long projects possibly exceeding $100. Even so, the report concludes the method is "relatively cheap." At that price, a single operator can afford many attempts and accept a low hit rate.
Fagerland told Reuters he had assumed hacking agents would still need some supervision, and that the technology had now moved past that. Agent fleets aimed at other companies' services are showing up elsewhere too: researchers traced a fleet of AI agents on Tencent Cloud that spent eleven days trying to pull data from Alibaba's Amap.
The exposed panels created a second problem. NorForge ran the secrets scanner Trufflehog over the panel data and found hundreds of secrets, 11% of which Trufflehog verified as valid. The report says some legitimate red teams had also left client tests on open panels, which exposes those clients too. NorForge says it has worked with Reuters to notify victims and is trying to get the panels taken down.
For site owners, one case shows what a finished intrusion looks like. NorForge fetched the shell URL from a completed task against a large hardware parts vendor, and it served an uploader webshell. According to the agent's own explanation, that intrusion combined unauthorized write access to a memcached session store with unsafe PHP object deserialization and an exploitable gadget chain in legacy Zend Framework components. NorForge notes that the exploitation paths differed from case to case.
