A single hacker let AI agents do almost all the work. A Chinese-speaking cybercriminal used autonomous AI agents to try to break into more than 1,200 websites and got into sites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins, according to a report by Snorre Fagerland, principal threat researcher at security firm NorForge, published on Monday, Oct. 19, 2026. Reuters, which saw the report before publication, identified the victims from its own review of the hacker's activity.

How the agents worked

Fagerland found the operations by scanning the internet for accidentally exposed copies of Cairn, an open-source AI problem-solving platform built for authorized penetration testing. Starting around Oct. 2, he found about two dozen Cairn instances being used maliciously, which let him watch the attackers' work as it happened, Reuters reported.

The Chinese-speaking operator, the most prolific of those he observed, began on Sept. 25 against U.S., Canadian, Australian and Japanese e-commerce sites. Their instructions to the agents were fewer than 100 Chinese characters. Successful intrusions took about 23 hours of probing on average, and Fagerland estimated the campaign used about $5,000 worth of AI tokens, or roughly $50 per successful hack. Reuters said the campaign appeared to use a mix of China's DeepSeek and Anthropic's Claude Code; The Hacker News noted the tasks ran under a worker named for both, but neither the researcher nor Reuters confirmed which models were used.

A typical task told the agents to find a way to run code on an online shop and then plant a web-shell uploader, The Hacker News reported. NorForge said the goal appeared to be lasting access to shop and payment systems, and that the overall success rate across the tools it saw was around 10%.

What the companies said

Reuters could not determine how much data, if any, was taken. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone product-support site and the threat was contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses also confirmed they were compromised.

Cairn's author, who posts as "le1xia0," told Reuters the tool was not designed for attacks and harmful use was not their intention. "It's a new world now," Fagerland said.

Why it matters

It is real-world evidence that commercially available AI agents can carry out complex intrusions from start to finish with little human direction, sharply raising what one attacker can do. It lands as AI-agent risk is getting more attention: OpenAI recently published its own agent misbehavior reports, and the U.S. ordered DeepSeek out of federal civilian agencies on Tuesday.