A cybersecurity researcher says he watched a Chinese-speaking hacker break into websites belonging to more than 100 companies while doing almost none of the work. According to Reuters, the AI agents the hacker set loose did the rest.
The account comes from Snorre Fagerland, whom Reuters describes as principal threat researcher at the security firm NorForge. NorForge published its findings on 19 October 2026, and Reuters ran an exclusive the same day. This article separates what NorForge says it saw, what Reuters established independently, and what the companies have said.
How it was found
NorForge's write-up says the trigger was a September 2026 report from Gambit Security on a criminal intrusion campaign against online marketplaces. Gambit recovered an attacker's staging server and found AI tools there, including one called Cairn. NorForge says tools like these often have web interfaces left open on the internet.
The Verge reports that Cairn describes itself as a "general-purpose problem-solving engine". Reuters calls it an open-source AI problem-solving platform popular with hackers. NorForge explains that users give it a starting point and an end goal, and its agents record what they find and decide their next move.
NorForge says it searched for exposed Cairn control panels with the Shodan and Censys search engines. It identified more than 20 panels as likely malicious. According to Reuters, Fagerland began finding about two dozen malicious instances around 2 October, and they let him follow the operators' activity. NorForge says all the malicious panels it found appeared to be financially motivated and that it saw no obvious state-sponsored activity.
The Chinese-speaking operator
NorForge groups the activity into three clusters. The biggest, which it labels AIA0001, uses Chinese-language instructions. NorForge counts 14 panels and over 1,100 attack projects, mostly against organisations in the US, Japan and Australia. It says the aim appears to be lasting access to e-commerce and payment systems for later monetisation, and it rates its confidence that the cluster is malicious as high.
Reuters adds that this operator began on 25 September against e-commerce sites in the US, Canada, Australia and Japan. It says the instructions ran to fewer than 100 Chinese characters, and that by late the previous week the agents had attempted more than 1,200 sites. Reuters says successful intrusions typically took around 23 hours. NorForge puts the average time from project start to goal at a little under 23 hours for the projects that succeeded, with one running more than five days.
NorForge says it is a reasonable assumption that, across the AI tools it saw, the average success rate is around 10%, with many other tasks reaching partial goals or gathering information for later attempts. Reuters reports Fagerland's estimate that the campaign used roughly $5,000 worth of tokens, or about $50 per successful hack. NorForge's own cost estimate is about $5 per task, including failed ones. It adds that the uncertainty is considerable and the numbers could be off by a clear margin.
On tooling, Reuters says the campaign appeared to use a mixture of China's DeepSeek and Anthropic's Claude Code. NorForge says the worker name it saw, claudecode_deepseek-v4.1-flash, could mean a Claude Code harness running DeepSeek 4.1 Flash.
Fagerland told Reuters his find was real-life evidence that commercially available AI agents could carry out complex intrusions from start to finish without human intervention. "It's a new world now," he said. He also said he was impressed by some of the techniques the agents used, adding: "It's not script kiddie stuff."
Who was hit
NorForge redacted its victims. Reuters says it worked out their identities by independently reviewing the hacker's Cairn activity, and it named three:
- Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed".
- SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained.
- Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Cummins spokesperson Melinda Koski gave The Verge the same statement.
Reuters says two smaller businesses also acknowledged being compromised and that other victims listed in the Cairn data did not return messages. It also says it could not ascertain how far the breaches led to data being taken.
The attackers left the doors open
NorForge's central finding is that these operators exposed their own infrastructure. It says the open panels revealed targets, weaknesses found, account secrets and API keys, and whether a target had been compromised. Running the secrets scanner Trufflehog over the panel data, it found "literally hundreds" of secrets, with 11% verified valid.
NorForge also says the panels appeared to expose what looks like the harness's full administrative controls, including starting and stopping projects and redirecting agents to other targets. It says it did not test whether those controls work without authorisation. NorForge says it is working with Reuters to notify victims and is trying to get the panels taken down, which it says depends on how the hosting providers respond. It describes the same exposure as a problem for legitimate red teams whose client data sat on unsecured panels.
What Cairn's creator says
Cairn's author, who uses the handle le1xia0, acknowledged a Reuters message but did not immediately answer its questions. Reuters quotes a recent X post saying the platform "was not designed for hacking attacks" and that harmful use "is not my intention". The Verge quotes the creator as saying earlier this month that "misuse is a human decision, not a feature of the engine."
Where this leaves the claim
The headline figure of more than 100 companies is the account of one researcher at one security firm, relayed by Reuters and The Verge. The named victims come from Reuters' own review. The companies' statements are what they gave Reuters, plus Cummins's matching statement to The Verge. As Reuters reports it, Fagerland had assumed hacker-agents would need some supervision, and said it was now obvious the technology had moved past that.
Sources
NorForge (2026) 'Inside Cairn: Open Windows into massive AI-Driven Cyber Operations', NorForge, 19 October 2026, available at: https://norforge.com/blog/inside_cairn (Accessed: 21 October 2026).
Reuters (Satter, R.) (2026) 'Exclusive-How one hacker used AI agents and a few thousand dollars to break into scores of sites', Reuters, 19 October 2026, available at: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ (Accessed: 21 October 2026).
The Verge (Roth, E.) (2026) 'A hacker broke into John Deere and SharkNinja with an army of AI agents', The Verge, 19 October 2026, available at: https://www.theverge.com/ai-artificial-intelligence/1013643/ai-agents-hack-john-deere-shark-ninja-cummins (Accessed: 21 October 2026).
Picture credits
- Top picture: Deere is one of the companies Reuters says was affected. This is a file photo of the company's headquarters, not of the website involved. John Deere World Headquarters, photo by dwhartwig, CC BY 2.0 (Wikimedia Commons)
- A file photo of Cummins' headquarters. Cummins told Reuters it was investigating a report concerning a website run by a third-party vendor. Cummins, Inc. Headquarters Building, Columbus, Indiana, photo by born1945, CC BY 2.0 (Wikimedia Commons)
