One Hacker Uses AI Agents to Breach Over 100 Company Websites for Just $5,000

A Chinese-speaking hacker used AI agents to break into more than 100 company websites while spending an estimated $5,000 on AI tokens, according to a Reuters investigation in October. The operation shows how one person can direct software to carry out complex attacks with little ongoing human input.

The targets included sites linked to Deere, SharkNinja and Cummins, although the reported impact differed across those companies. After the campaign began on September 25, the agents attempted to compromise more than 1,200 websites, mainly online stores in the United States, Canada, Australia and Japan.

Snorre Fagerland, principal threat researcher at NorForge, uncovered the activity while searching for exposed Cairn installations, an open-source platform that coordinates AI agents. Around October 2, he found roughly two dozen installations apparently being used for malicious activity.

How Cairn Automated the Attacks

Cairn is a general-purpose problem-solving engine rather than a tool built only for hacking. In the attacks described in NorForge’s technical report, operators supplied a target and a goal, then agents searched for weaknesses and worked toward gaining access.

The platform stores findings on a shared project board so its agents can use earlier discoveries to choose their next steps. That allows them to try different paths when an initial approach fails, instead of relying on a single fixed scan.

NorForge tracked the largest Chinese-language activity cluster as AIA0001, linking it to 14 dashboards containing more than 1,100 attack projects. Its target pipeline used Microsoft’s Playwright browser automation tool to check that shopping sites could accept orders before passing them to Cairn.

The task instructions focused on finding ways to run code without signing in, including SQL injection, unsafe file uploads, login bypasses and unsafe handling of stored objects. The apparent aim was lasting access to shopping and payment systems that could later generate money.

NorForge confirmed one claimed breach by checking a reported address on a hardware vendor’s website and finding a live uploader webshell. This server-side script allowed files to be placed on the compromised site, creating a foothold for further attacks.

According to the agent’s own account, that attack combined unauthorized write access to a memcached session store with unsafe PHP object deserialization and older Zend Framework components. The chain turned weaknesses in session storage and object processing into server access, rather than depending on one obvious entry point.

In another case, agents moved beyond a company’s main application after failing to find a weakness. They searched related infrastructure, found an exposed control panel, and spent hours testing its handling of data before reporting that they could run commands on the server.

Low Costs, Long Running Agents

Successful AIA0001 projects took just under 23 hours on average, while one ran for more than five days. Across the observed campaigns, NorForge estimated success at around 10%, although goals and targets varied between operators.

Fagerland estimated the main campaign consumed about $5,000 in tokens, or roughly $50 per successful intrusion. These figures are estimates, not confirmed billing records. NorForge separately put the average task cost near $5 when failed and early-ending attempts were included, warning that uncertainty was substantial.

Worker names suggested a Claude Code setup using a DeepSeek model, but NorForge did not confirm the full model configuration. Chinese-language instructions also do not establish the operator’s nationality, and researchers found no obvious state-backed activity in the exposed panels.

Related reporting on AI agents used to steal retail credit card data described a separate campaign involving Cairn and other tools. Another investigation into DeepSeek-powered credential theft showed attackers using agents to exploit exposed secrets and weak settings, rather than relying on new flaws.

Deere told Reuters it took corrective action and found no indication that attackers accessed sensitive information. SharkNinja said the affected system was a separate product support site and that the threat had been contained. Cummins was investigating a possible attack on a third-party-run website.

Reuters could not determine how much data, if any, was taken across the breaches. NorForge also found hundreds of exposed secrets in the open panels and said it was working with Reuters to notify victims.

The exposure also affected legitimate security testers. NorForge found unsecured testing dashboards revealing customer information, showing that poorly protected AI tools create risk during authorized work.

Defenders should patch public-facing applications, restrict access to admin panels, and watch for unexpected files in web directories. Security teams should also review suspicious web requests and isolate servers where webshells are found, then investigate for stolen data, further access, and other malware before restoring service.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post One Hacker Uses AI Agents to Breach Over 100 Company Websites for Just $5,000 appeared first on Cyber Security News.