AI agents reportedly broke into websites tied to more than 100 companies with little human help

Criminals used autonomous AI agents to probe more than 1,200 websites and gain access to sites associated with more than 100 companies, according to an investigation described by The Hacker News, citing Reuters’ review of the operators’ records. The named companies included Deere, SharkNinja and Cummins. It is not known how much data, if any, the attackers took.

The activity came to light after Snorre Fagerland, a researcher at security firm NorForge, scanned for internet-exposed copies of Cairn, an open-source tool that gives agents a goal and lets them work through tasks step by step. Starting around Oct. 2, Fagerland found about two dozen instances being used maliciously and could watch their activity through unsecured control panels. NorForge judged more than 20 panels likely malicious and grouped them into three clusters.

The busiest cluster, which NorForge calls AIA0001, used Chinese-language instructions and linked 14 panels to more than 1,100 projects. Typical tasks directed agents to find a way to run code on an online shop and plant a web-shell uploader. NorForge said the apparent objective was to establish access to shop and payment systems for possible later use. In one case it checked, the shell was live; the researcher also confirmed a compromise at a large U.S. retailer, where an agent found a cookie setting that selected a vulnerable backend server.

The reported intrusions did not all follow the same path. One documented chain involved unauthorized write access to a memcached session store, unsafe handling of saved PHP objects and a weakness in old Zend Framework code. Deere said it had taken steps to address the issue and had no indication sensitive information was accessed. SharkNinja said the attack affected a standalone product-support site and had been contained. Cummins said it was investigating a possible attack on a site run by a vendor.

NorForge estimated that successful break-ins took just under 23 hours on average and put the overall success rate for the activity it observed at about 10%. It cautioned that the clusters pursued different goals, making them difficult to compare. The firm’s rough cost estimate was about $5 per task, including failed or prematurely ended attempts; Fagerland separately told Reuters the campaign had used about $5,000 in tokens, or roughly $50 per successful hack.

The model and coding setup remain unconfirmed. NorForge saw tasks running under a worker named “claudecode_deepseek-v4.1-flash,” which could indicate a DeepSeek model operating through Anthropic’s Claude Code. The researcher and Reuters did not verify that interpretation. Cairn’s creator, who uses the name “le1xia0,” told Reuters the tool was designed for authorized penetration testing, not hacking attacks, and that harmful use was not intended.

The exposed panels created a separate security risk: they contained information about targets, discovered weaknesses, credentials and keys. NorForge’s scan found hundreds of secrets, 11% of which it said were still valid. The panels also appeared to offer controls for managing projects and changing targets, though the researcher said it had not tested whether those controls could be used without logging in. NorForge also found apparently legitimate penetration-testing firms with client work on unsecured panels.

The findings illustrate how agents can take a short instruction and carry out extended reconnaissance and exploitation attempts, while also leaving sensitive records exposed when their operators fail to secure the surrounding infrastructure. But the reported campaign does not establish that AI agents can reliably breach arbitrary sites: NorForge’s estimated success rate was limited, the observed clusters were not directly comparable, and the extent of damage at the named organizations remains uncertain.