Chinese-speaking hacker used AI agents to target more than 100 company websites | Межа

The agents targeted businesses in the United States, Canada and Australia, as well as Japanese e-commerce sites, and had tried to access more than 1,200 websites by October 18, 2026.

A Chinese-speaking hacker used AI agents to probe and gain unauthorized access to more than 100 websites belonging to well-known companies, including farming equipment maker Deere and kitchen appliance company SharkNinja, Reuters reported. The agents took advantage of exposed instances of Carin, an open-source AI-powered problem-solving platform popular among hackers.

This is reported by Tom’s Hardware .

Snorre Fagerland, principal threat researcher at cybersecurity company NorForge, noticed the activity while monitoring Carin instances that had been inadvertently exposed. He observed several hackers, but Reuters said the Chinese-speaking hacker was the most prolific. The hacker used fewer than 100 Chinese characters to direct the agents.

The agents did more than try random approaches. In one case, they searched digital records for infrastructure linked to a target, found a publicly accessible control panel, identified a weakness and used it to execute malicious commands, Reuters reported.

“It’s not straightforward to come up with solutions like that,” Fagerland told Reuters. “It’s not script kiddie stuff.” – Snorre Fagerland

“It’s not straightforward to come up with solutions like that,” Fagerland told Reuters. “It’s not script kiddie stuff.”

The approach lets operators give AI agents instructions and leave them to work without supervision, freeing the operators to focus elsewhere. SharkNinja told Reuters that the attack affected only a site providing product support information. One hacker monitored by Fagerland stole credit card data; another tried to steal from a cryptocurrency exchange, though it is unclear whether that attempt succeeded.

Other news you may find interesting:

Natura unveiled Interface, a $99 smart ring for interacting with AI agents, controlling connected devices and tracking health metrics. The company plans a $9 monthly subscription after an initial free period.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.