An AI agents hacking campaign has hit more than 100 company websites, and the human behind it barely lifted a finger. Security researchers at NorForge say a Chinese-speaking attacker pointed swarms of autonomous agents at online stores and let them find their own way in. Victims reportedly include farm equipment maker Deere, appliance brand SharkNinja and engine maker Cummins.
How the AI Agents Hacking Campaign Worked
The attacker used Cairn, an open-source AI platform that calls itself a general-purpose problem-solving engine. You give it a starting point and a goal, and a team of AI agents works toward that goal step by step. Each agent posts what it learns to a shared board that the others, and the human operator, can read.
In this case, the goal was simple and nasty. The agents were told to find a way to run code on a target website, then plant a small upload tool called a web shell. That kind of foothold can give attackers lasting access to a shop and its payment systems for later use.
A pipeline that fed targets automatically
The busiest group did not pick victims by hand. An automated pipeline fed in lists of real online stores in the US, Canada, Japan and Australia, each with roughly 200,000 to 1.5 million in traffic. According to Reuters, which saw the research before it went public, the agents had tried to break into more than 1,200 sites by late last week.
NorForge says every task in that group ran on a worker labeled “claudecode_deepseek-v4.1-flash.” The firm reads that as a Claude Code style harness running DeepSeek’s low-cost V4.1 Flash model, though it is only an interpretation of the label. Successful break-ins took a little under 23 hours on average.
Key Numbers From the NorForge Report
Here is a quick look at the figures researchers and reporters have shared so far. Keep in mind that NorForge itself calls its cost estimates rough.
| Detail | Reported figure |
|---|---|
| Websites compromised by the main hacker | More than 100 |
| Break-in attempts by that group | More than 1,200 |
| Exposed Cairn panels judged likely malicious | More than 20 |
| Average time to a successful break-in | Just under 23 hours |
| Estimated cost per successful hack | About $50 |
| Estimated average success rate | About 10% |
The researcher behind the report, Snorre Fagerland, estimated the campaign used roughly $5,000 worth of AI tokens. That cheap price tag is what worries security teams the most.
What the Victims Are Saying
The companies named so far say the damage looks limited. Deere said it took remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and that the threat was contained.
Cummins said it was investigating a report of a possible attack on a website run by one of its third-party vendors. It is still not clear how much data, if any, the attackers took.
The tool’s creator pushes back
Cairn’s author, who posts online as le1xia0, says the platform was never built as a hacking tool. The developer argues that misuse is a human choice, not a feature of the engine. NorForge says it is working to get the malicious panels taken down and to warn affected companies.
Why This AI Hacking Case Stands Out
The attackers made a careless mistake that let researchers watch them work. Many operators left their Cairn control panels open on the public web, where NorForge found them with internet scanning tools starting around October 2. Those panels also leaked hundreds of passwords, API keys and other secrets, and about 11% of the ones checked were still valid.
NorForge spotted more than one crew. Besides the Chinese-language group, an English-speaking group openly told its agents to steal credit cards and cryptocurrency. This fits a wider pattern of rogue AI agents causing real damage this year.
- Attacks that once needed a skilled team can now run mostly on autopilot.
- Costs are low enough that criminals can try thousands of targets.
- Mid-size online stores are prime targets, not just giant brands.
- Open AI tools can be repurposed quickly, even when built for good uses.
The scary part is not one clever hack. It is that a single person can now run a hacking operation at the scale of a small team for the cost of a nice dinner per break-in.
What This Means for You
If you run a website or online store, this is a good moment to tighten the basics. Automated attackers go after old, unpatched software and forgotten admin panels, because those are the easiest wins.
- Update your store platform, plugins and server software, especially older PHP and Magento setups.
- Lock down or remove any admin panels and test tools that face the public internet.
- Rotate API keys and passwords if you suspect they were ever exposed.
- Watch for unexpected files on your server, like new upload forms you did not add.
- Use the same caution with your own AI tools and never leave their dashboards open to the web.
Businesses already using agents should also review how much access those agents get. Our recent look at agent security controls covers the zero-access approach many vendors now recommend. You can also explore AI threat detection and browse our cybersecurity AI tools for defensive options.
For shoppers, the advice is simpler. Use virtual or single-use card numbers where your bank offers them, and check your statements often. For more stories like this, visit our AI news hub.
Sources
This report draws on coverage from The Verge and The Next Web, both summarizing NorForge’s research and Reuters reporting on the victims.
Conclusion
This case shows that AI agents are no longer just a lab worry for cybersecurity. One attacker, a free open-source tool and a cheap AI model were enough to break into more than 100 business websites with very little human effort. The named companies say the impact was limited, but the low cost and high speed of these attacks mean many more sites will be tested the same way. If you run anything online, patching old software and closing exposed panels is the best defense you have right now.
