Chinese Hacker Used AI Agents to Breach More Than 100 Company Websites

A cybersecurity investigation has revealed how a single hacker used artificial intelligence (AI) agents to attack websites belonging to more than 100 companies. The campaign reportedly targeted businesses across several countries, showing how AI tools can make sophisticated cyberattacks easier to carry out.

According to reporting based on research by cybersecurity specialist Snorre Fagerland of NorForge, the hacker used Cairn, an open-source AI problem-solving platform, to automate much of the work involved in finding and exploiting website vulnerabilities.

More Than 1,200 Websites Targeted

The AI-assisted campaign reportedly attempted to break into more than 1,200 websites in the United States, Canada, Australia, and Japan. More than 100 company websites were reportedly compromised.

The targets included websites associated with Deere, the agricultural equipment manufacturer; SharkNinja, known for home appliances; and Cummins, an engine manufacturer. The extent of any data access or theft was not established for every affected website.

Researchers reportedly discovered the activity while monitoring exposed Cairn instances being used for suspicious purposes. This allowed them to observe how the AI agents were being directed and how they attempted to access targeted systems.

How AI Agents Carried Out the Attacks

Rather than manually investigating every website, the hacker gave the AI agents relatively brief instructions and allowed them to work for extended periods.

The agents reportedly searched for weaknesses, examined related digital infrastructure, and tried different approaches when initial attempts failed. In one case described by the researcher, agents reportedly found a related public-facing control panel and identified a weakness that could be used to make a server execute malicious commands.

This kind of activity goes beyond simply running a basic, automated script. AI agents can adapt their next steps based on what they discover, potentially allowing one operator to investigate many targets with less direct supervision.

However, the reported activity does not mean that AI can automatically break into every website. Success still depends on factors such as security weaknesses, system configuration, available access, and the capabilities and limitations of the tools being used.

The Estimated Cost of the Campaign

The researcher estimated that the operation consumed approximately $5,000 worth of AI processing tokens. Based on the reported number of successful intrusions, that works out to roughly $50 per successful compromise.

Successful intrusions typically took around 23 hours of probing and experimentation, according to the reporting. These figures are estimates rather than independently confirmed costs for every attack.

The relatively low estimated expense highlights a potential problem for businesses: attackers may be able to use commercially available AI services and open-source tools to scale their efforts without needing a large team of human hackers.

What the Affected Companies Said

The companies' responses varied.

• Deere: The company said it had taken necessary steps to address the incident and had no indication that sensitive information was accessed.
• SharkNinja: The company said the incident affected a standalone product-support website and that the threat had been contained.
• Cummins: The company said it was investigating a report of a potential cyberattack involving a website operated by a third-party vendor.

The investigation did not establish the full extent of unauthorized data extraction across all reported victims. As a result, it would be inaccurate to assume that every compromised website suffered the same type or level of data loss.

Why AI-Powered Cyberattacks Are a Growing Concern

AI agents can carry out multi-step tasks with limited human intervention. In cybersecurity, that ability can help legitimate teams assess systems and identify vulnerabilities, but it can also be misused to automate reconnaissance and intrusion attempts.

The key concern is scale. A malicious operator may be able to launch many investigations in parallel, allowing the software to spend hours testing different possibilities while the operator focuses on other tasks.

Open-source tools are not inherently malicious, and Cairn was described as a general-purpose problem-solving platform rather than a tool created specifically for hacking. The incident illustrates how general-purpose technology can be repurposed for harmful activity.

How Businesses Can Reduce Their Risk

Organizations can reduce their exposure by taking several practical steps:

• Keep website software, plugins, servers, and dependencies updated.
• Regularly scan internet-facing systems for known vulnerabilities.
• Secure administrative panels and avoid exposing them unnecessarily.
• Use strong authentication, including multifactor authentication for important accounts.
• Monitor server logs and network activity for unusual requests or command execution.
• Review third-party vendors' security practices and access permissions.
• Maintain tested backups and an incident-response plan.

Security teams should also consider how AI-assisted attacks may behave differently from traditional automated scans. Unusual patterns of requests, repeated attempts across related systems, or unexpected administrative activity can warrant closer investigation.

What This Incident Means for the Future of Cybersecurity

The reported campaign demonstrates that AI agents can assist a single attacker in conducting complex, lengthy investigations against many targets. It does not mean human expertise has become irrelevant, but it does show why businesses need to strengthen their defenses and monitor emerging attack techniques.

As AI tools become more capable and widely available, organizations will need to combine routine security maintenance with effective monitoring, rapid patching, and careful oversight of third-party systems.

Source note: This article is an original rewrite based on reporting about research by NorForge's Snorre Fagerland. Some details remain estimates or allegations, and the full extent of data access was not established.