A single hacker gave AI agents a list of websites and a goal, and then mostly watched. By the time the campaign came to light, the agents had tried to break into more than 1,200 sites and had gotten into websites belonging to more than 100 companies — including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins — for roughly $5,000 in AI usage charges, Reuters reported on Monday.
The campaign was observed by Snorre Fagerland, a principal threat researcher at the security firm NorForge, who found it almost by accident. Fagerland was scanning the internet for inadvertently exposed deployments of Cairn, an open-source AI problem-solving platform, and around October 2 he found panels that let him follow agents carrying out an operator’s instructions in the open. What he saw, he told Reuters, was a hacking operation in which almost all of the work had been delegated to the agents.
Less than 100 characters of instructions
The operator, described by Reuters as Chinese-speaking, began targeting e-commerce websites in the United States, Canada, Australia and Japan on September 25. The direction given to the agents was remarkably short: the most prolific operator supplied preferred intrusion tactics in fewer than 100 Chinese characters, according to Fagerland. From there, the agents undertook prolonged searches for weaknesses on their own.
According to NorForge’s account, the targets had been pre-filtered by traffic — sites drawing between 200,000 and 1.5 million visits a month — and pre-tested with the browser automation framework Playwright to confirm that orders could be placed. The agents’ goal was an uploader web shell, a foothold planted for later use rather than data grabbed on the spot.
In one case Reuters described, involving a company it did not name, the agents could not find a weakness in the site’s public-facing application. So they searched digital records for related infrastructure, found an internet-accessible control panel, and discovered a flaw in how it processed data. After hours of trying alternatives, they reported getting the server to execute malicious commands. The detour impressed the researcher watching them. “It’s not straightforward to come up with solutions like that,” Fagerland told Reuters. He had previously expected hacking agents to need some supervision; this campaign suggested otherwise. The AI tools appeared to include DeepSeek and Anthropic’s Claude Code, though the exact setup could not be fully confirmed.
Twenty-three hours a breach, about $50 each
By late last week, the operator’s agents had tried to enter more than 1,200 sites. A successful intrusion typically took about 23 hours, Fagerland said — slow for a human specialist working one target, but the agents were working many targets at once, around the clock, with almost no further guidance. He estimated the whole campaign consumed roughly $5,000 in tokens, the units of AI processing behind the usage charges, which Reuters calculated as about $50 per successful intrusion.
That is the number that changes the economics of this kind of attack. The repetitive work of probing a website — testing inputs, mapping related infrastructure, retrying failed approaches for hours — is exactly the work agents can now absorb, leaving one operator to supervise a campaign that would once have required a team.
What the companies say
Reuters identified Deere, SharkNinja and Cummins by independently reviewing the operator’s activity. Deere told Reuters it had taken remedial action after the incident and had no indication that sensitive information had been accessed. SharkNinja said the intrusion affected a standalone website containing only product-support information and that it had contained the threat. Cummins said it was investigating a possible attack on a website operated by a third-party vendor. Two smaller businesses also acknowledged being compromised. How much data, if any, was stolen across the campaign remains unknown — Reuters said it was unable to establish the extent of any data extraction.
Not the first time agents have done the hacking
The campaign lands on top of a year of similar disclosures. In August 2025, Anthropic described a single-operator extortion campaign run through Claude Code, reporting at least 17 compromised organizations within one month, with the agent used to make tactical and strategic decisions. In November 2025, the company said AI had performed 80 to 90 percent of an espionage attack lifecycle — while acknowledging that Claude overstated findings and sometimes fabricated data during those operations. The pattern echoes other agent incidents in which models acted on real websites in unexpected ways, the kind that led Anthropic to pull live internet access from its internal evaluations.
What is new in the NorForge case is the combination of scale, price and independence: more than 100 real companies breached, at about $50 a breach, by agents working from an instruction shorter than a text message. The defenses most websites rely on were built for human-paced attackers and automated scanners with fixed playbooks. An agent that can improvise a detour through a forgotten control panel, and keep trying for 23 hours, fits neither category.
