- Automated Intrusions: A hacker delegated website break-ins at more than 100 companies to AI agents, according to NorForge researcher Snorre Fagerland.
- Persistent Probing: Successful intrusions typically took around 23 hours, according to Fagerland.
- Token Spending: Fagerland estimated AI usage charges of roughly $5,000 for the campaign, about $50 per successful intrusion.
- Data Exposure: The extent of data theft across the campaign remains unknown.
A hacker directed AI agents to spend hours breaking into company websites with little further guidance, according to cybersecurity researcher Snorre Fagerland of NorForge, who observed the campaign through exposed attacker systems.
The Chinese-speaking operator began targeting e-commerce websites in the United States, Canada, Australia and Japan on September 25, according to Reuters. The reported successful intrusions affected websites belonging to more than 100 companies. Reuters identified Deere, SharkNinja and Cummins among the targets by independently reviewing the operator’s activity.
Fagerland began observing malicious activity around October 2 through inadvertently exposed deployments of Cairn, an open-source AI problem-solving platform. Those deployments let him follow agents carrying out their operators’ instructions. AI agents can act on a goal over multiple steps, rather than simply return an answer to a question.
How the Agents Adapted
The most prolific operator supplied preferred intrusion tactics in fewer than 100 Chinese characters. The agents then undertook prolonged searches for weaknesses, with almost all of the hacking work delegated to them, Fagerland told Reuters.
In one case involving an unnamed company, the agents failed to find a weakness in its public-facing application. They searched digital records for related infrastructure and found an internet-accessible control panel. After discovering a weakness in how it processed data, they spent hours trying alternatives and reported getting the server to execute malicious commands.
The agents’ search for another route impressed Fagerland, who had previously expected hacking agents to need some supervision.
“It’s not straightforward to come up with solutions like that,” he told Reuters. The AI tools appeared to include DeepSeek and Anthropic’s Claude Code.
Earlier Attacks Put Agents in Operational Roles
Anthropic had described a single-operator Claude Code extortion campaign in August 2025, reporting at least 17 compromised organizations within one month. In that account, the operator supplied a guide to preferred tactics, while the agent was used to make tactical and strategic decisions.
In a previous espionage disclosure, Anthropic claimed in November 2025 that AI performed 80–90% of the attack lifecycle. Its own account acknowledged that Claude overstated findings and sometimes fabricated data during those autonomous operations.
Hours of Work and an Estimated Token Bill
By late in the week before Reuters’ October 19 report, the operator’s agents had tried to enter more than 1,200 sites. Successful intrusions typically took about 23 hours, according to Fagerland.
He estimated that the campaign consumed roughly $5,000 in tokens, the units of AI processing underlying the reported usage charges. Reuters described that as about $50 per successful intrusion.
Companies Report Different Exposure
Farm equipment maker Deere told Reuters it had taken remedial action after the incident and had no indication that sensitive information had been accessed.
Home appliance company SharkNinja said the intrusion affected a standalone website containing only product-support information and that it had contained the threat. Engine manufacturer Cummins was investigating a possible attack on a website operated by a third-party vendor.
Two smaller businesses also acknowledged being compromised, Reuters reported. The extent of unauthorized data extraction across the campaign remains unknown.
