The criminals left their control room unlocked. Through those open dashboards, a researcher watched one Chinese-speaking hacker hand an intrusion campaign to AI agents that broke into more than 100 company websites , spending an estimated $50 in AI tokens for each successful break-in.
The agents tried to break into more than 1,200 websites in the US, Canada, Australia and Japan and got into over 100, according to Snorre Fagerland, principal threat researcher at NorForge.
Fagerland estimated the campaign used $5,000 worth of AI tokens, or roughly $50 per successful hack, with each successful intrusion taking 23 hours.
Victims include Deere, SharkNinja and Cummins. How much data the hacker took has not been confirmed.
Fagerland went looking for exposed copies of Cairn, an open-source tool that gives AI agents a starting point and a goal, then lets them work toward it step by step. Operators often leave its web interface unprotected. From around October 2, he found two dozen Cairn panels in malicious use.
The panels showed everything: targets, findings, stolen credentials and live progress. NorForge links 14 of them to the Chinese-speaking operator, a group it labels AIA0001, with more than 1,100 attack projects between them. The campaign began on September 25. By late last week, the agents had tried more than 1,200 sites.
Fewer Than 100 Characters of Instructions
The hacker barely typed. Instructions to the agents ran to fewer than 100 Chinese characters. An automated pipeline picked the targets: real shopping sites with 200,000 to 1.5 million visitors, each checked first with Microsoft’s Playwright browser-automation tool to confirm that orders could go through.
The goal was remote code execution without logging in. A typical task told the agents to plant an “uploader” shell, a bare file-upload form that leaves a door open for later. NorForge checked one claimed success on a hardware parts vendor’s site and found the shell live.
Every task ran through a worker named “claudecode_deepseek-v4.1-flash”. NorForge reads that as Anthropic’s Claude Code harness driving DeepSeek’s V4.1 Flash model. Successful projects averaged a little under 23 hours and 140 findings each. One ran for more than five days.
Fagerland had assumed hacking agents would still need a human watching over them. The campaign proved otherwise, and some of the agents’ techniques impressed him. “It’s not straightforward to come up with solutions like that,” Fagerland said.
Fagerland’s report did not name victims. Journalists identified several by reviewing the hacker’s Cairn activity. Deere said it took remediation steps and saw no indication that sensitive information was accessed. SharkNinja said the affected standalone site carried product support information and that the threat was contained. Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.”
Two smaller businesses also confirmed compromises. Nobody has yet established how much data the hacker took.
Cost estimates depend on how you count. Fagerland put the whole campaign at $5,000 in tokens. NorForge’s written estimate averages roughly $5 per task across all attempts, failures included, and warns that the margin of error is wide.
Attackers With Poor Security of Their Own
The open panels also leaked victims’ secrets. NorForge ran the Trufflehog scanner over the exposed data and found hundreds of credentials and keys, 11% of them verified as valid. The dashboards seemed to expose full admin controls, so a stranger could in theory redirect the agents. NorForge says it is helping notify victims and pressing hosting providers to take the panels down.
For companies on the receiving end, the advice is old but urgent: patch exposed web apps, rotate leaked keys and keep a breach response plan ready.
The same toolkit has surfaced before. In September, Gambit Security described a campaign that chained three open-source AI harnesses , Strix, Cairn and Hermes, to compromise at least 27 organizations and copy more than 600,000 payment card records at $25 a target. Inside companies, autonomous agents also create a new identity security problem , because each agent holds credentials of its own.
Officials are paying attention. G7 finance leaders agreed last week to run drills against AI-driven cyberattacks , and Google DeepMind chief Demis Hassabis has described recent agent hacks as early warning shots . Fact-checkers have documented how AI agents carried out hacks without human oversight earlier this year. The Cairn campaign puts the same capability in criminal hands, running on rented servers.
Written by Vytautas Valinskas
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
