Over the past few weeks a Chinese-speaking attacker broke into websites belonging to more than 100 companies, among them farm equipment maker Deere, appliance maker SharkNinja and engine manufacturer Cummins. He handed nearly all of the work to AI agents. Reuters reports this based on research by Snorre Fagerland, principal threat researcher at the security firm NorForge.
Cairn was sitting open on the web
Fagerland scanned the web for inadvertently exposed instances of Cairn, an open-source agentic problem-solving platform popular with hackers. From around October 2 he found about two dozen instances being used for attacks, which let him watch over the attackers’ shoulders while their tools ran.
His report does not name the victims. Reuters identified them by independently reviewing the attacker’s Cairn activity. Deere said it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the hack hit a standalone site carrying only product support information and that the threat was contained. Cummins said it is “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” Two smaller businesses also confirmed a breach. How much data actually left remains unclear.
About $50 per successful break-in
The Chinese-speaking attacker was the most prolific of several Fagerland watched. One stole a trove of credit card data; another tried to rob a crypto exchange. Starting September 25, the first set his agents loose on ecommerce sites in the US, Canada, Australia and Japan. His instructions fit into fewer than 100 Chinese characters. By late last week the agents had attempted more than 1,200 sites, and a successful intrusion typically took around 23 hours of probing.
According to Fagerland the campaign ran on a mixture of DeepSeek and Anthropic’s Claude Code, and chewed through roughly $5,000 worth of tokens. That works out to about $50 per successful break-in.
Fagerland has spent nearly three decades in security and was impressed by some of the techniques. In one case the agents found no weakness in a large company’s public-facing application, so they combed digital records for associated infrastructure, located a public-facing control panel, spotted a subtle flaw in how it processed data, and after hours of trial and error got the server to execute commands. “It’s not straightforward to come up with solutions like that,” he says. “It’s not script kiddie stuff.”
Cairn’s author, who goes by “le1xia0” on social media, acknowledged a Reuters message but did not answer its questions. In a recent post on X he wrote that his platform is “an innovative type of multi-agent architecture” and was not designed for hacking attacks.
Nobody had to supervise
Fagerland says he assumed until recently that hacker agents would need at least some supervision. He no longer thinks so. South Korea and Japan have both seen several well-publicised hacks in recent weeks attributed to criminals using AI. In August the Israeli firm Gambit Security found Russian-speaking extortionists breaking into seven organisations with SpaceX’s Cursor. In September Gambit documented an agent-driven spree that hit 25 companies and stole at least 600,000 credit card records. Cyber intelligence firm BitSight reports that talk of autonomous agents is surging on criminal forums.
For those of us who use Claude Code, the uncomfortable part is not the attacker. It is the arithmetic. $5,000 in tokens for 1,200 attempted sites means the tool we build prototypes with is worth roughly a small team in the hands of one attacker. Model providers have classifiers and blocks for exactly this. An agent platform left open on the web, spreading its jobs across several providers, walks right past them.