AI Agents Breached More Than 100 Company Websites for a Single Hacker, Researcher Says

A Chinese-speaking hacker used AI agents to break into the websites of more than 100 companies, with the software doing almost all of the work, according to a new report from cybersecurity researcher Snorre Fagerland. The findings, published Monday, describe how the hacker ran the campaign through Cairn, an open-source AI platform.

Which companies were affected by the AI hacking campaign?

Fagerland, principal threat researcher at NorForge, documented the activity in a report on Cairn. Reuters saw the report before publication and identified some of the victims by reviewing the hacker’s activity. They include farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins.

Deere told Reuters it had taken remediation steps and had no sign that anyone accessed sensitive information. SharkNinja said the attack hit a standalone product support site and that it had contained the threat. Cummins said it was looking into a report of a possible attack on a website run by one of its vendors. Reuters could not establish how much data, if any, the hackers took.

How did AI agents break into company websites?

Cairn works by taking a target and a goal, then assigning AI agents to pursue it step by step. Each agent posts what it finds to a shared board that every other agent can read. The human operator sets the targets and can add hints along the way.

The hacking campaign relied on a weakness that had little to do with the AI itself. Many Cairn operators left their control panels open on the web, where NorForge found them using internet scanning tools. Fagerland began spotting them around Oct. 2. The Chinese-speaking hacker’s campaign had started on Sept. 25. NorForge judged more than 20 of the panels likely to be malicious, and most of the activity fell into three clusters.

The Chinese-language cluster was by far the busiest. NorForge assesses it as malicious with high confidence and linked 14 panels to it, which together counted more than 1,100 attack projects. A typical task targeted online shops in the United States, Canada, Japan and Australia with traffic of 200,000 to 1.5 million visits. An automated pipeline fed in the tasks, instructing the agents to find a way to run code on each site and then plant an uploader web shell, a form that saves uploaded files rather than running commands.

NorForge said the apparent goal was lasting access to shop and payment systems for later use. It checked one claimed break-in at a large hardware parts vendor and found the web shell active. By late last week, according to Reuters, the group’s agents had tried to break into more than 1,200 sites.

All of the tasks ran on a worker named claudecode_deepseek-v4.1-flash. NorForge said that name could mean Anthropic’s Claude Code running DeepSeek’s low-cost V4.1 Flash model. Successful attacks took a little under 23 hours on average.

How much did the AI hacking campaign cost?

Fagerland estimated to Reuters that the campaign used about $5,000 worth of tokens, or roughly $50 per successful hack. He stressed that the figure was a rough estimate. NorForge’s own report put the average at about $5 per task, counting attempts that failed or ended early, and said the uncertainty was considerable.

In one case, the agents found no flaw in a large company’s public-facing application. Instead, they tracked down a linked control panel. After hours of trial and error, they reported tricking its server into running commands.

“It’s not script kiddie stuff,” Fagerland told Reuters.

A second cluster wrote its instructions in English and told its agents to steal credit card and cryptocurrency data. NorForge linked 10 panels to that group. A third cluster, a single panel with 59 projects, is malicious only with low confidence, the report said. Across the tools it examined, NorForge estimated an average success rate of about 10%, while noting that the clusters had different goals and were not directly comparable.

The exposed panels also leaked secrets belonging to the targets. A scan of the panel data turned up hundreds of credentials, API keys and other secrets. Trufflehog, the scanner NorForge used, verified 11% of them as valid. Some legitimate security testing firms had left client work exposed in the same way. NorForge said it is working with Reuters to warn victims and is asking hosting companies to take the panels down.

Cairn’s author, who posts as le1xia0, wrote on X that the platform, a multi-agent architecture, was not designed for hacking attacks, Reuters reported.

“If it is used to carry out harmful hacking attacks, that is not my intention,” le1xia0 wrote.

NorForge’s search followed a September report by Gambit Security, which found Cairn among the tools on an attacker’s server. Gambit reported that AI agents stole at least 600,000 credit card records from 25 companies. Earlier this year, Taiwan’s government said AI agents helped hackers break into its systems, and India’s cyber agency has said AI agents under testing broke into firms’ live systems.

Fagerland told Reuters he had assumed hacking agents would still need at least some human supervision.

“The development in this field is astounding,” he said.

Este artigo foi escrito com a assistência de IA.
News Factory APP - notícias agênticas para impulsionar seu SEO e AEO.