AI agents reportedly hacked 100+ companies for about $50 a site

Fewer than a hundred Chinese characters: that is all a hacker wrote to their artificial intelligence agents, according to the report published on October 19 by Snorre Fagerland, principal researcher at NorForge. The agents then worked on their own. Since September 25, they have tried to break into more than 1,200 sites in the United States, Canada, Australia and Japan. More than 100 are believed to have fallen.

Reuters, which reviewed the findings, identified three victims: Deere, SharkNinja and Cummins. The researcher sums up the level of the attacks in one line: “It's not script kiddie stuff.”

Dashboards left open on the Internet

The tool is called Cairn. On this open-source platform, you set a target and a goal; AI agents move forward step by step and share their findings on a common board. Many users left its control panel accessible from the Internet. Around October 2, NorForge found several while scanning the network and was able to follow the attacks.

The main group, Chinese-speaking, managed more than 1,100 attack projects spread across 14 panels. NorForge assesses it as malicious with high confidence. A second, English-speaking group targeted bank cards and cryptocurrencies. All of the first group's tasks ran on a module named claudecode_deepseek-v4.1-flash. According to NorForge, the name could refer to Anthropic's Claude Code tool, used with DeepSeek's low-cost V4.1 Flash model.

How much does an intrusion cost?

A successful attack took just under 23 hours on average, and about one attempt in ten succeeded. Snorre Fagerland estimates the total spend at $5,000 in compute, or about $50 per compromised site. He presents this figure as a rough estimate. His report also puts the average cost of a task at about $5, failures included.

The companies named play down the incidents. Deere says it applied a fix and saw no sign of access to sensitive information. SharkNinja describes an isolated support site and a contained threat. Cummins is investigating a possible attack on a site run by a contractor. Reuters could not establish whether any data was stolen. On X, Cairn's author, who goes by le1xia0, replied that the software was not designed for hacking and that malicious use was not their intention.

Best practices

The agents' strength lies in their patience: in one case, they kept trying for hours before getting a server to run commands. And the exposed panels themselves leaked hundreds of credentials and API keys, 11% of which were still valid according to NorForge.

• Never expose the interface of an AI agent tool on the Internet, even for a test.
• Watch for long, methodical probing of your sites: a successful attack here took nearly a day.
• Inventory secondary sites (support, contractors): these were the ones targeted at SharkNinja and possibly at Cummins.

Attackers had already relied on AI coding tools, as in the hacking of South Korean banks. What changes here is the scale reached by a single person. NorForge says it is working with Reuters to warn the victims and is asking hosting providers to shut down the exposed panels.