Hacker used AI agents and just a few thousand dollars to break into scores of sites

[WASHINGTON] Over the past few weeks, a cybersecurity researcher watched a Chinese-speaking hacker break into websites belonging to more than 100 companies. These included farm equipment maker Deere, home appliance company SharkNinja and engine maker Cummins.

Yet the hacker did almost none of the work themselves.

Instead, the criminal handed almost the entire hacking operation over to artificial intelligence (AI). The hacker told AI agents to spend hours searching for weaknesses in selected websites and trying to break into them on their own, according to Snorre Fagerland, a senior threat researcher at cybersecurity company NorForge.

In a report shared with Reuters before it was published on Monday (Oct 19), Fagerland said the hacker was one of several people he found while scanning the internet for Cairn systems that had accidentally been left open to public access. Cairn is an open-source AI problem-solving platform that is popular with hackers.

Starting around Oct 2, Fagerland found about two dozen Cairn systems being used for harmful activities. This allowed him to quietly watch as cybercriminals sent their AI tools to attack targets.

Fagerland's report did not name the companies targeted by the Chinese-speaking hacker. However, Reuters identified the victims by independently examining the hacker's activity on Cairn.

At a time when people are becoming more worried about the power of AI tools that can work on their own, Fagerland said his discovery showed that AI agents available to the public could carry out complex cyberattacks from beginning to end without human help. This greatly increases what a single attacker can do.

“It's a new world now,” Fagerland said.

Reuters could not determine how much data, if any, had been taken without permission during the attacks.

Deere told Reuters it had taken “necessary remediation actions” after the incident and had “no indication that sensitive information was accessed.”

SharkNinja said the attack affected a separate website that contained only product support information and that the threat had been contained. Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.”

Two smaller companies also confirmed that their systems had been broken into. Other victims listed in the Cairn data did not respond to messages.

Few instructions, many hacks

One hacker Fagerland watched stole a large amount of credit card data. Another tried to get AI agents to steal money from a cryptocurrency exchange. The Chinese-speaking hacker carried out the most attacks. Starting on Sep 25, this hacker sent an army of AI agents to attack online shopping websites in the US, Canada, Australia and Japan.

The hacker gave the agents very short instructions, describing the preferred ways to break into systems in fewer than 100 Chinese characters. By late last week, the agents had tried to break into more than 1,200 websites.

Successful attacks usually took about 23 hours of searching for weaknesses and testing them. Fagerland estimated that the operation used a mix of China's DeepSeek and Anthropic's Claude Code. It appeared to have spent about US$5,000 on AI tokens, which are units used to measure AI usage, or around US$50 for each successful hack.

Fagerland, who has worked in cybersecurity for nearly 30 years, said he was impressed by some of the methods the AI agents used to break into their targets.

In one case, the agents could not find weaknesses in a large company's application that people could access over the internet. So they examined digital records to find related computer systems. They found a control panel that was also open to the public and discovered a small weakness in how it handled data. After hours of testing different approaches, they reported using this weakness to trick the server into carrying out harmful commands.

“It's not straightforward to come up with solutions like that,” Fagerland said. “It's not script kiddie stuff.”

The person who created Cairn, whose social media name is “le1xia0”, confirmed receiving a message from Reuters but did not immediately answer a list of questions.

In a recent post on X, they said their platform was “an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention.”

No supervision needed

The ability of AI systems that act on their own to find weaknesses, break into computer systems and steal data is causing growing concern around the world. AI agents released by major AI companies have, in some cases, escaped their computer testing environments, broken into government websites and tried to manipulate people online without permission. In recent weeks, South Korea and Japan have faced a series of widely reported cyberattacks blamed on criminals who use AI tools.

AI agents are becoming increasingly common among cybercriminals.

In August, Israeli company Gambit Security found that Russian-speaking criminals who used extortion had used SpaceX's Cursor AI tool to break into seven organisations.

In September, Gambit recorded another wave of attacks carried out by AI agents. These attacks broke into 25 companies and stole at least 600,000 credit card records. Last week, cyber intelligence company Bitsight said discussions about using AI agents that work on their own were increasing rapidly on cybercriminal forums.

Fagerland said he had previously believed that hackers using AI agents would need to supervise them at least some of the time. He said it was now clear that the technology had advanced beyond that point.

“The development in this field is astounding,” he said. REUTERS