Over the past few weeks, a cybersecurity researcher has observed a Chinese-speaking hacker compromise the websites of more than one hundred companies. Among those affected were agricultural equipment manufacturer Deere, home appliance maker SharkNinja, and engine producer Cummins.
The hacker himself performed only a minor part of the work, as he almost entirely delegated this hacking campaign to artificial intelligence. According to information provided by Snorr Fagerland, a leading threat researcher at NorForge, the cybercriminal instructed AI agents to autonomously spend hours scanning and infiltrating target sites.
In a new report, Fagerland stated that this hacker is one of several he discovered while searching for accidentally exposed instances of Cairn—an open-source platform for solving problems using AI, popular among hackers. Around October 2nd, Fagerland found about two dozen instances of Cairn being used for malicious activities, allowing him to discreetly monitor the actions of cybercriminals as they deployed their AI tools globally.
Fagerland's report on the Chinese-speaking hacker did not name the victims, but Reuters was able to identify them by independently studying the hacker's activity in Cairn.
Amid growing concern over the power of autonomous AI tools, Fagerland noted that his finding provides real evidence that commercially available AI agents are capable of conducting complex end-to-end intrusions without human intervention, significantly enhancing the capabilities of a single attacker. 'This is a new world now,' Fagerland stated. Reuters could not determine the extent to which the leaks led to unauthorized data extraction.
Instructions were brief
Deere reported that following the incident, it took 'necessary corrective actions' and 'has no indication of access to confidential information.' SharkNinja stated that the breach affected an autonomous website containing only product support information, and the threat was localized. Cummins indicated that it is 'investigating a report of a potential cyberattack on a website exploited by one of our third-party suppliers.'
Two smaller companies also confirmed the compromise. Other victims listed in the Cairn data did not respond to messages. One of the hackers observed by Fagerland stole a large volume of credit card data. Another attempted to make AI agents rob a cryptocurrency exchange. The Chinese-speaking hacker proved to be the most active. Starting September 25th, he launched his army of AI against e-commerce sites in the US, Canada, Australia, and Japan.
Their instructions were very concise, describing preferred intrusion tactics in less than 100 Chinese characters. By the end of last week, their agents had attempted to hack over 1200 sites. Successful penetrations typically took about 23 hours of vulnerability scanning.
Fagerland calculated that this campaign, which apparently used a combination of China's DeepSeek and Anthropic's Claude Code, cost approximately $5,000 in tokens—text units processed by AI models for which payment is made—or about $50 per successful hack.
Fagerland, with nearly thirty years of experience in cybersecurity, was impressed by some of the methods used by the agents. In one instance, after the agents failed to find weaknesses in a major company's public application, they analyzed digital records to find related infrastructure, discovered a public control panel, and identified a subtle flaw in data processing. After many hours of trial and error, they reported using this vulnerability to trick the server into executing malicious commands.
'It's not that easy to come up with such solutions,' Fagerland noted, adding that it was 'not script-kiddy level,' meaning inexperienced hackers relying on ready-made tools.
The author of Cairn, whose social media handle is 'le1xia0', did not immediately respond to a series of questions. In a recent post on X, he stated that the platform 'is an innovative type of multi-agent architecture and is not intended for hacking attacks. If it is used to carry out malicious hacking attacks, that is not my intention.'
The ability of AI agent systems to autonomously find vulnerabilities, execute intrusions, and steal data raises growing global concern. Malicious agents unintentionally released by large AI companies have hacked computer labs, infiltrated government websites, and conducted unauthorized social engineering attempts. In recent weeks, South Korea and Japan have been affected by a series of high-profile hacks attributed to cybercriminals using AI, including a South Korean bank hack linked by the cybersecurity firm CrowdStrike to a Chinese AI agent and Claude Code.
AI agents are increasingly becoming an integral part of the cybercriminal underworld. In August, the Israeli firm Gambit Security discovered that Russian-speaking ransomware operators used Cursor, an AI code-writing tool owned by SpaceX, to hack seven organizations. In September, Gambit documented a wave of AI agent-driven attacks that resulted in breaches across 25 companies and the theft of at least 600,000 credit card records. Last week, the cyber intelligence firm Bitsight reported a sharp increase in discussions about using autonomous agents on cybercriminal forums.
Fagerland previously suggested that hacking agents would require at least some supervision. It is now clear that the technology has gone beyond that. 'The development in this area is astonishing,' he concluded.