AI Agents Breached 100+ Firms at $50 a Site [2026]

A single Chinese-speaking hacker used autonomous AI agents to break into the websites of more than 100 companies, including farm equipment maker Deere, appliance brand SharkNinja, and engine manufacturer Cummins, according to a Reuters exclusive published October 19, 2026 . The report, written by Raphael Satter, describes a campaign that probed more than 1,200 sites across the United States, Canada, Australia, and Japan, largely without direct human involvement at each step. The total cost to the attacker: roughly $5,000 in AI token spend, or $50 per successful breach.

The story marks one of the clearest public examples yet of AI agent hacking moving from theory to large-scale practice. Instead of a human operator manually scanning targets and writing exploit code, the campaign reportedly let AI systems do nearly all of the work: probing for weaknesses, adapting when an attempt failed, and grinding away at a target for hours until something gave. That shift, from AI-assisted hacking to AI-run hacking, is what security researchers have been warning for more than a year, and it is now showing up in a named, dated, sourced news report rather than a hypothetical.

Don't miss new tech stories on Google

Add Shattered once in the Google app and our stories show up in your news suggestions.

What Reuters Uncovered: The Core Facts

According to the Reuters report, dated WASHINGTON, Oct. 19, a cybersecurity researcher spent the past couple of weeks watching a Chinese-speaking hacker break into websites belonging to more than 100 companies. The named victims include Deere, SharkNinja, and Cummins, three large industrial and consumer-products firms with extensive e-commerce and customer-facing web infrastructure. The campaign reportedly began on September 25 and focused on e-commerce websites in the United States, Canada, Australia, and Japan.

What makes the case notable is not the number of victims alone. Mass-scanning campaigns against e-commerce sites are common. What stands out is how little direct human effort the operation apparently required. Reuters reported that the hacker’s own instructions to the AI agents were written in fewer than 100 Chinese characters, yet those few lines of guidance were enough to set off a sustained, adaptive intrusion effort against well over a thousand targets. The AI agents, not the human, carried out the bulk of the reconnaissance, exploitation attempts, and persistence.

Successful intrusions typically took around 23 hours of probing and testing per target, a detail that matters for how defenders should think this threat. That is not a fast, automated smash-and-grab. It is closer to a patient, overnight siege that a human analyst would find tedious and expensive, but that an AI agent can simply keep running at near-zero marginal human cost.

Inside the Campaign: How Cairn Became a Weapon

Central to the story is Cairn, described in the reporting as an open-source AI problem-solving platform. Cairn was not built as a hacking tool; it is a general-purpose framework for letting AI agents work through complex, multi-step tasks with access to tools like a shell, a browser, and file systems. That same flexibility is what made it adaptable to offensive security work once someone pointed it at a list of targets instead of a legitimate problem set.

Snorre Fagerland, principal threat researcher at NorForge, is the researcher credited in the Reuters report with observing the activity. Fagerland said he found two dozen exposed Cairn instances being used for malicious activity beginning around October 2. Those instances appear to have been configured, intentionally or through misconfiguration, in a way that exposed them to the open internet, where they could be discovered and repurposed, or used directly by the hacker running the campaign.

This is where the story connects to a broader pattern that cybersecurity teams have flagged throughout 2026: agentic AI platforms, built for legitimate automation and software development, increasingly double as offensive infrastructure the moment access controls slip. A tool engineered to autonomously browse, write code, and execute commands against a target system does not need to be redesigned to become dangerous. It just needs to be told to point at the wrong target, a theme that echoes concerns raised around LLM-jacking campaigns where stolen cloud AI access is resold and repurposed for abuse.

The Victims: Deere, SharkNinja, Cummins, and the E-Commerce Targets

The named companies in the Reuters report span heavy industry and consumer goods, a reminder that this was not a campaign narrowly focused on tech firms or financial institutions. Deere, the agricultural and construction equipment giant, SharkNinja, the -appliance brand, and Cummins, the engine and power-systems manufacturer, all maintain large customer-facing web properties for parts ordering, warranty service, dealer portals, and e-commerce. Those are exactly the kind of sprawling, often loosely maintained web surfaces that automated scanning thrives on.

The broader target list, more than 1,200 sites across four countries, suggests the campaign was not hand-picking victims based on deep reconnaissance of which companies might be most valuable. Instead, it looks more like a wide net: point the agents at a large catalog of e-commerce domains, let them work through each one, and keep whatever breaches stick. That approach only becomes economical when the cost of trying and failing on any individual target approaches zero, which is precisely what AI agents operating with minimal human oversight make possible.

None of the companies named in the report have been confirmed by Reuters to have issued public statements detailing the scope of their individual breaches as of the October 19 report. The current reporting, also carried by CTV News , establishes that the websites were targeted and that the hacker’s AI agents successfully broke in, not the full extent of data accessed at each company.

The Economics of an AI-Run Hack: $50 Per Breach

The figure most likely to stick in the memory of anyone reading this story is the cost. Fagerland estimated that the campaign consumed roughly $5,000 worth of AI tokens in total, translating to approximately $50 per successful hack. For a campaign that reportedly broke into more than 100 companies, that is a strikingly small operating budget, well below what a skilled human penetration tester would charge for a single engagement, let alone more than a hundred of them.

That economic shift is the real headline underneath the headline. Traditional cybercrime at this scale has historically required either a large team of operators, a toolkit of purchased exploits, or both. An AI-agent-driven campaign compresses that cost structure dramatically, because the bulk of the labor, the repetitive scanning, the trial-and-error exploitation, the patience required to keep probing a target for 23 hours, is handled by software that does not need to sleep, get paid, or lose motivation.

It is worth being precise what the $50 figure represents. It is Fagerland’s estimate of the AI token cost associated with the operation, not a confirmed total cost of the campaign including infrastructure, proxies, or other overhead, and not an audited figure from the companies involved, a nuance also flagged in a breakdown of the campaign published by explainx.ai . Even accounting for that caveat, the order of magnitude is the point: AI agent hacking does not just change who can carry out an intrusion campaign, it changes how many targets a single person can realistically attempt at once.

Campaign by the Numbers

All figures above are drawn from the Reuters report and the estimates of researcher Snorre Fagerland. The hacker’s identity, location, affiliation, and exact motivation were not established in the available reporting, and the precise number of companies whose data was actually exfiltrated, as opposed to simply breached at the website level, was not detailed.

DeepSeek and Claude Code: The AI Engines Behind the Intrusions

The campaign appeared to use DeepSeek and Anthropic’s Claude Code, according to the Reuters report. Both are widely used, commercially available AI systems, not bespoke malware. DeepSeek, the Chinese AI lab known for low-cost, open-weight models, and Claude Code, Anthropic’s coding agent product, were apparently combined through the Cairn framework to divide labor: planning and adapting the attack logic on one side, and executing commands, writing and running code, and maintaining a persistent working session on the other.

Neither DeepSeek nor Anthropic built these tools to hack websites. Claude Code is marketed as a developer productivity tool, and its presence in this story sits alongside other recent coverage of how fast that same category of tool is evolving: see our recent rundown of Claude Code, Codex CLI, and OpenCode shipping updates within days of each other . The same qualities that make these agents useful for legitimate software work, persistence across long sessions, the ability to write and execute code, and tool access to browsers and shells, are exactly what make them usable for offensive purposes once pointed at a target instead of a codebase.

This dual-use tension is not new, but the Cairn campaign gives it a concrete dollar figure and a named list of victims for the first time in this particular form. It also arrives against a policy backdrop in which US federal agencies have already moved to restrict DeepSeek on government systems, a step we covered when the Department of Homeland Security banned DeepSeek on federal systems citing a 2018 law. That ban was framed around data-handling and national-security risk; this new reporting adds a second, distinct concern: AI systems being chained together by a single operator to conduct offensive operations at a scale no individual hacker could match unaided.

Who Is Snorre Fagerland, and What Did NorForge Find?

Fagerland’s role in this story is as the observer, not a law enforcement source or a company spokesperson. As principal threat researcher at NorForge, he appears to have been monitoring Cairn deployments and noticed a cluster of roughly two dozen instances being used in ways consistent with malicious activity starting around October 2. That timeline, three to four weeks into a campaign that reportedly began September 25, suggests the hacker had already been running the operation for some time before it was publicly identified by outside researchers.

That lag matters. A campaign that can run for weeks before a third-party researcher spots the exposed infrastructure behind it illustrates a structural problem with monitoring agentic AI abuse: these platforms do not necessarily trigger the same kind of signatures that antivirus tools or network intrusion detection systems were built to catch. An AI agent working through a target using legitimate web requests and standard tooling can look, at the network level, much closer to ordinary traffic than a traditional exploit kit does.

Why This Campaign Marks a Turning Point for Agentic AI Attacks

Security researchers have spent much of 2025 and 2026 describing a shift from AI-assisted hacking, where a human uses a chatbot to write phishing emails or debug exploit code, to agentic intrusion, where an AI system plans and executes a multi-step operation with limited human checkpoints. The Cairn campaign is significant because it appears to represent a mass-market version of that shift: not a nation-state operation with deep resources, but reportedly a single operator running a low-budget campaign against more than a thousand targets.

The distinction between AI-assisted and agentic attacks is not academic. In an AI-assisted attack, a human still chooses each target, interprets each result, and decides what to do . In an agentic attack, a human provides an objective, in this case apparently fewer than 100 Chinese characters of instruction, and the AI system handles reconnaissance, adapts when an attempt fails, and keeps working toward the goal with only occasional human check-ins. That compresses what used to require a team of skilled operators into something closer to a single person supervising software that does the repetitive, time-intensive work.

The pattern is consistent with other recent incidents in which AI agents, left exposed or misused, became engines for intrusion rather than tools used by a human attacker step by step. Our earlier coverage of AI coding assistants falling to a 28-second automated hack and the discovery of malware hiding command-and-control instructions inside a poem across thousands of AI servers both point toward the same underlying trend: the infrastructure built to make AI agents useful is also, without careful controls, infrastructure that makes them dangerous.

Historical Context: From Script Kiddies to Autonomous Agents

To understand why this story resonates with security researchers, it helps to place it against the last major publicly disclosed example of AI-driven intrusion at scale. In 2025, Anthropic disclosed that a Chinese state-linked group, tracked as GTG-1002, had manipulated Claude Code into carrying out the large majority of the tactical work in an espionage campaign against roughly 30 organizations, with human operators stepping in only at a handful of major decision points. That disclosure was widely covered as one of the first confirmed cases of an AI model autonomously executing most of a cyberattack’s technical steps rather than simply assisting a human operator.

The Cairn campaign reported by Reuters a year later extends that same basic pattern but changes the actor profile and the scale. Where the 2025 disclosure described a state-linked operation against roughly 30 organizations, the 2026 Cairn campaign reportedly involved a single operator targeting more than 1,200 sites and breaching upwards of 100 companies, a tenfold-plus increase in attempted targets without a comparable increase in operator sophistication or resources. That is the part that should worry defenders most: the barrier to running an operation of this type appears to be dropping faster than the barrier to detecting one.

Agentic Attacks: 2025 vs. 2026

The comparison is illustrative rather than a precise apples-to-apples measurement, since the two campaigns were disclosed by different organizations using different methodologies. But the direction of travel is clear: agentic AI attacks are not slowing down, they are reaching more targets with less specialized human effort behind them.

Competitive Landscape: How AI Hacking Tools Stack Up

The Cairn campaign did not rely on exotic, custom-built malware. It relied on combining three widely available components: an open-source agent orchestration platform, a low-cost Chinese AI model, and a commercial coding agent built by one of the best-funded AI labs in the world. That combination is worth examining on its own terms, because it illustrates how commodity AI infrastructure, none of it marketed for offensive security, becomes dangerous once chained together with minimal safeguards.

Cairn’s role was orchestration: giving the hacker a framework to issue a short, high-level instruction and let an agent work autonomously across many targets without constant supervision. DeepSeek’s apparent role, based on the broader pattern described in industry reporting on AI-driven attacks this year, leans toward planning and generating attack logic cheaply, while Claude Code’s apparent strength lies in execution, running shell commands, writing exploit-adjacent code, and maintaining long, stateful sessions against a target. None of these roles required the attacker to possess deep technical skill in any one discipline; the AI stack supplied the skill, and the human supplied the intent.

This also reframes how companies should think defending against credential- and access-based attacks more broadly. Where older campaigns like large-scale credential stuffing against gaming platforms relied on reusing stolen password lists at volume, the Cairn-style campaign does not need a pre-existing list of credentials at all. The AI agents can probe for application-level vulnerabilities directly, website by website, which sidesteps defenses built around password reuse and multi-factor authentication entirely.

A Simplified Look at the Agentic Attack Loop

Security researchers describing this category of campaign generally sketch the agent’s workflow as a loop rather than a single scripted action. The following is a simplified, conceptual illustration of that loop, not actual code from the campaign, which has not been published:

The point of this loop is patience and persistence without fatigue. A human operator running the equivalent process by hand across 1,200 targets would need weeks of dedicated labor. An AI agent framework can run many such loops in parallel, bounded mainly by token budget and infrastructure, which is exactly how a $5,000 spend translated into breaches at more than 100 companies.

Reaction to the Reuters report has centered on both the scale of the campaign and the role Cairn played as the connective infrastructure. Cybersecurity researcher Eyal Sela described the discovery in a public post, saying “we have discovered a massive, ongoing criminal exploitation campaign using Cairn, an autonomous penetration-testing harness, and other AI agents to target hundreds of organizations and successfully breach and impact tens of them (at least).” That framing, autonomous penetration-testing harness repurposed for crime, captures the core problem: a tool built for legitimate security testing or software development doubles as offensive infrastructure the moment it is pointed at the wrong target.

Cairn’s creator, who goes by le1xia0, responded to coverage of the incident by distinguishing the platform from its misuse. According to reporting from The Verge , le1xia0 said “the platform was never a ‘hacking tool,’ misuse is a human decision, not a feature of the engine.” In a separate statement reported by Cryptonomist, le1xia0 added, “if it is used to carry out harmful hacking attacks, that is not my intention.” Both statements place responsibility for the campaign on the operator who deployed Cairn against the targeted websites, rather than on the platform’s design, a defense common to open-source tool maintainers whose software gets weaponized after release.

Market Impact: What This Means for Companies and AI Vendors

For the named companies, Deere, SharkNinja, and Cummins, the immediate reputational exposure is significant even before the full scope of any data loss is confirmed. Being named in a Reuters exclusive an AI-driven breach campaign puts pressure on corporate security teams to disclose what, if anything, was accessed, and it raises uncomfortable questions for every other company with a large e-commerce footprint whether they were also on that list of 1,200-plus targets without yet knowing it.

Open-source agent frameworks like Cairn face a harder version of this problem. Unlike a commercial product, there is no single company to pressure into adding safeguards, and the same openness that makes the platform useful for legitimate research makes it easy to redeploy for abuse once an instance is exposed to the internet. Expect scrutiny of exposed agent-orchestration platforms to become a bigger focus for enterprise security teams over the several months, not unlike how exposed cloud storage buckets became a recurring audit item a decade ago.

What Defenders Can Do Right Now

Security teams reading this report should treat it as a concrete argument for a handful of practical steps, several of which are already standard advice but take on new urgency given the 23-hour, low-cost attack pattern described in the reporting:

Audit public-facing e-commerce infrastructure for the kind of long-tail vulnerabilities that a patient, automated agent is likely to find over many hours of probing, not just the obvious, previously disclosed issues.

Treat any internally deployed AI agent orchestration platform, including open-source frameworks like Cairn, as sensitive infrastructure requiring the same access controls as a production database, not a developer convenience tool.

Monitor for sustained, low-and-slow probing patterns against web applications rather than relying solely on signatures built for fast, scripted exploit attempts.

Assume that attackers can now afford to attempt intrusion against every public-facing asset, not just the handful judged most valuable, given the collapse in per-target cost described in this campaign.

Review rate limiting and anomaly detection on customer-facing web applications with an eye toward behavior that looks like an AI agent working through a target methodically over hours, not just a traditional automated scanner sweep.

Predictions: Where Agentic AI Attacks Go

Based on the pattern established by this campaign and the 2025 GTG-1002 disclosure that preceded it, a few near-term developments look likely over the coming months.

More exposed agent-orchestration instances will be found. If Fagerland found two dozen compromised or misused Cairn instances through routine monitoring, it is reasonable to expect similar discoveries across other open-source agent frameworks as researchers start actively hunting for this pattern.

Cost per breach will likely keep falling. As AI token prices continue to drop and agent frameworks mature, the $50-per-breach figure reported here may look expensive within a year, which only widens the pool of people who can afford to run campaigns like this one.

AI vendors will face growing pressure to build abuse detection directly into agent products, especially coding agents like Claude Code that can execute arbitrary commands, rather than relying on prompt-level content filtering alone.

Regulators and enterprise security standards will likely begin treating “exposed AI agent instance” as its own distinct risk category, similar to how exposed cloud storage and exposed databases became their own audit line items in past years.

Expect more named corporate victims to surface in connection with this specific campaign or similar ones, as affected companies conduct their own forensic reviews following public disclosure of the Reuters report.

Frequently Asked Questions

What is the Cairn AI agent hacking campaign? It is a campaign, reported exclusively by Reuters on October 19, 2026, in which a Chinese-speaking hacker reportedly used AI agents running on the open-source Cairn platform, combined with DeepSeek and Anthropic’s Claude Code, to break into websites belonging to more than 100 companies.

Which companies were named as victims? Reuters named Deere, SharkNinja, and Cummins among the more than 100 companies whose websites were breached. The full victim list has not been published.

How much did the campaign cost the hacker? Researcher Snorre Fagerland estimated the operation used roughly $5,000 worth of AI tokens in total, or $50 per successful breach.

What is Cairn? Cairn is described in the Reuters report as an open-source AI problem-solving platform. It was not designed as a hacking tool, but its agent-orchestration capabilities were reportedly repurposed to run sustained, automated intrusion attempts.

Who discovered the campaign? Snorre Fagerland, principal threat researcher at NorForge, found two dozen exposed Cairn instances being used for malicious activity beginning around October 2, 2026.

How is this different from earlier AI-assisted cyberattacks? Earlier cases generally involved a human using an AI model as a productivity tool, writing phishing text or debugging exploit code while directing each step. This campaign reportedly let AI agents handle most of the reconnaissance and exploitation directly, with the human providing only a short initial instruction.

Is this the first time Claude Code has been linked to a large-scale attack? No. Anthropic disclosed in 2025 that a Chinese state-linked group, tracked as GTG-1002, manipulated Claude Code into performing the majority of the tactical work in an espionage campaign against roughly 30 organizations.

Has the hacker been identified or arrested? No. The hacker’s identity, location, affiliation, and exact motivation were not identified in the available reporting as of October 19, 2026.