One hacker’s AI agents broke into John Deere and SharkNinja sites for $50 each

One hacker broke into the websites of more than a hundred companies, including farm-equipment maker Deere, appliance brand SharkNinja and engine manufacturer Cummins, and left nearly all of the work to AI agents. The attacker sketched out favourite intrusion tactics in a few lines of Chinese, then let the agents spend hours probing each target and breaking in without further help. Snorre Fagerland, principal threat researcher at the security company NorForge, watched it happen and says each successful hack cost the attacker roughly fifty dollars in AI usage.

That price changes who gets attacked. Breaking into a company website used to take a skilled person days of patient work, so criminals saved it for targets worth the effort. When a machine does the probing for the cost of a takeaway dinner, the online shops where you leave your address and card number are worth hitting too, even small ones. Fagerland told Reuters that he had assumed hacking agents would still need a human to supervise them, and that the campaign he saw showed the technology had already moved past that point.

The attacker was exposed by the tools they used. Fagerland was scanning the internet for copies of Cairn, an open-source platform that sets AI agents loose on a problem from a start point to a goal and logs every step, that had been left publicly reachable. From early October he found about two dozen exposed Cairn setups running malicious jobs, which let him read the agents’ work logs as they went. The Chinese-speaking hacker was the most prolific of the group. Another operator stole a trove of credit card data, and a third tried to get its agents to rob a cryptocurrency exchange.

According to Fagerland’s figures, the busiest campaign aimed at e-commerce sites in the United States, Canada, Australia and Japan. By late last week the agents had tried to break into more than 1,200 sites. A successful intrusion took about 23 hours of trial and error, and the whole run burned through roughly $5,000 in tokens on a mix of DeepSeek models and Claude Code. In one case the agents found no weakness in a large company’s main web application, so they searched public records for other servers linked to it, found an exposed control panel and spent hours testing a subtle flaw in how it handled data until, by their own report, they could make the server run their commands. “It’s not straightforward to come up with solutions like that,” Fagerland said. “It’s not script kiddie stuff.”

There are limits to what is known. NorForge’s report does not name any victims; Reuters identified Deere, SharkNinja and Cummins by going through the attacker’s Cairn activity itself, and could not establish how much data, if any, was taken. Deere said it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed”. SharkNinja said the attack hit a standalone site holding only product-support information and that the threat was contained. Cummins said it was investigating a potential attack on a website run by one of its third-party vendors. Two smaller businesses confirmed they had been breached, and the remaining companies did not reply. A break-in of a support page is not a raid on a customer database, and these agents still needed most of a day per target.

Cairn itself was not built as a weapon, its creator argues. The developer, who posts as le1xia0, wrote on X that the platform is “an innovative type of multi-agent architecture and was not designed for hacking attacks”, adding that “if it is used to carry out harmful hacking attacks, that is not my intention.” Earlier this month the same developer wrote that misuse “is a human decision, not a feature of the engine.” The trouble is that a tool which tirelessly tries a thousand routes to a goal does not care whether that goal is a solved puzzle or a server.

The NorForge case is the clearest look yet at a trend researchers have been tracking for months. In August the Israeli firm Gambit Security found Russian-speaking extortionists using an AI coding tool to break into seven organisations, and in September it documented an agent-driven spree that hit 25 companies and took at least 600,000 credit card records. Last week the threat intelligence company Bitsight reported that talk about autonomous agents is surging on cybercriminal forums.

For now, NorForge says it is working to get the malicious Cairn setups taken offline, and the report was published on October 19. Taking them down removes the window Fagerland looked through, not the agents behind it. The next campaign only has to keep its dashboard private.

Tags: Cybersecurity, AI agents, Cairn, Cummins, John Deere, NorForge