Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including US farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins.
Yet the hacker did almost none of the work.
Instead, the cybercriminal outsourced the hacking spree almost entirely to AI, tasking AI agents with spending hours autonomously probing and breaking into targeted sites, according to Snorre Fagerland, principal threat researcher at cybersecurity company NorForge.
In a new report, Fagerland said the hacker was one of several he discovered while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. Beginning around 2 October, Fagerland said he found about two dozen instances of Cairn being used for malicious activity, which allowed him to quietly look over the cybercriminals’ shoulders as they set their AI tools loose on the world.
Fagerland’s report on the Chinese-speaking hacker did not name the victims, but Reuters was able to establish their identities by independently reviewing the hacker’s Cairn activity.
At a time of rising anxiety over the power of autonomous AI tools, Fagerland said his find was real-world evidence that commercially available AI agents could pull off complex intrusions from start to finish without human intervention, a dramatic boost to the power of a single malicious actor.
“It’s a new world now,” Fagerland said. Reuters could not establish to what degree the breaches resulted in data being extracted without authorisation.
Instructions were terse
Deere said it had taken “necessary remediation actions” following the incident and had “no indication that sensitive information was accessed”. SharkNinja said the hack had hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was “investigating the report of a potential cyberattack on a website operated by one of our third-party vendors”.
Two smaller businesses also acknowledged being compromised. Other victims listed in the Cairn data did not return messages.
One of the hackers Fagerland observed stole a trove of credit card data. Another tried to get AI agents to rob a cryptocurrency exchange. The Chinese-speaking hacker was the most prolific. Beginning on 25 September, they set their AI army loose against e-commerce websites in the US, Canada, Australia and Japan.
Their instructions were terse, sketching out their preferred intrusion tactics in fewer than 100 Chinese characters. As of late last week, their agents had attempted to break into more than 1 200 sites. Successful intrusions typically took around 23 hours of probing for vulnerabilities.
Fagerland estimated that the campaign, which appeared to use a mixture of China’s DeepSeek and Anthropic’s Claude Code, had consumed roughly US$5 000 worth of tokens – the units of text that AI models process and charge for – or about $50 per successful hack.
Fagerland, who has worked in cybersecurity for nearly three decades, said he was impressed by some of the techniques the agents used. In one case, after failing to find any weaknesses in a big company’s public-facing application, the agents pored through digital records to find associated infrastructure, located a public-facing control panel and discovered a subtle weakness in the way it processed data. After hours of trial and error, they reported using it to trick the server into executing malicious commands.
“It’s not straightforward to come up with solutions like that,” Fagerland said. “It’s not script kiddie stuff,” he added, referring to inexperienced hackers who rely on ready-made tools.
Cairn’s author, whose social media handle is “le1xia0”, did not immediately answer a list of questions. In a recent post on X, they said the platform was “an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention”.
The ability of agentic AI systems to discover vulnerabilities, carry out intrusions and steal data on their own is a source of growing anxiety around the world. Rogue agents inadvertently unleashed by major AI companies have hacked their way out of computer labs, broken into government websites and made unsanctioned social engineering attempts. South Korea and Japan have in recent weeks been hit by a series of well-publicised hacks attributed to AI-using cybercriminals, including a hack on South Korean banks that cybersecurity company CrowdStrike linked to a Chinese-developed AI agent and Claude Code.
AI agents are increasingly becoming staples of the cybercriminal underground. In August, Israeli firm Gambit Security found that Russian-speaking extortionists had used Cursor, the AI coding tool owned by SpaceX, to break into seven organisations. In September, Gambit documented an AI agent-driven spree that resulted in breaches at 25 companies and the theft of at least 600 000 credit card records. Last week, cyber intelligence company Bitsight said that discussions about how to use autonomous agents were surging across cybercriminal forums.
Fagerland said he had previously assumed hacker agents would need at least some supervision. It was now obvious, he said, that the technology had moved past that. “The development in this field is astounding,” he said. — Raphael Satter, © 2026 Reuters
