One Hacker, Cheap AI Agents and Over 100 Breached Websites: What Small Businesses Should Know

A cyber security researcher has documented how a single Chinese-speaking hacker used AI agents to break into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins. According to Snorre Fagerland, principal threat researcher at NorForge, the hacker did almost none of the work. Instead, AI agents were tasked with spending hours autonomously probing and breaking into targeted sites.

Fagerland found the activity while scanning the web for accidentally exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. From around October 2, he found about two dozen instances being used for malicious purposes, which let him watch the attackers at work. One stole a trove of credit card data, and another tried to get AI agents to rob a cryptocurrency exchange. The Chinese-speaking hacker was the most prolific. Fagerland's report did not name victims, but Reuters identified them by reviewing the hacker's Cairn activity.

Reuters could not determine how much data was taken. Deere said it had taken "necessary remediation actions" and had no indication sensitive information was accessed. SharkNinja said a standalone site carrying only product support information was hit and the threat was contained. Cummins said it was investigating a potential attack on a website run by a third-party vendor. Two smaller businesses also acknowledged being compromised. Fagerland said the find is real-life evidence that commercially available AI agents can carry out complex intrusions from start to finish without human intervention, greatly boosting a single attacker's power.