A hacker used artificial intelligence agents to hack into websites belonging to more than 100 companies.
The individual, who speaks Chinese, targeted several businesses, including John Deere and SharkNinja.
Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins.
Yet the hacker did almost none of the work.
The cybercriminal instead outsourced the hacking spree almost entirely to artificial intelligence, tasking AI agents with spending hours autonomously probing and breaking into targeted sites, according to Snorre Fagerland, principal threat researcher at the cybersecurity company NorForge.
In a report provided to Reuters ahead of publication on Monday, Fagerland said the hacker was one of several he discovered while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. Beginning around October 2, Fagerland said he found about two dozen instances of Cairn being used for malicious activity, which allowed him to quietly peer over the cybercriminals' shoulders as they set their AI tools loose on the world.
Fagerland's report on the Chinese-speaking hacker did not name the victims, but Reuters was able to establish the victims' identities by independently reviewing the hacker's Cairn activity.
At a time of rising anxiety over the power of autonomous AI tools, Fagerland said his find was real-life evidence that commercially available AI agents could pull off complex intrusions from start to finish without human intervention, a dramatic boost to the power of a single malicious actor.
Today's 18 AI stories in under 7 minutes 🍲 One hacker's AI agents got into sites at 100+ companies for about $50 a break-in (a researcher's estimate, via Reuters). OpenAI races to raise $30B before Anthropic's IPO. And Sam Altman's three endgames for AI. In this episode: 0:27 One hacker, an army of AI agents 1:40 OpenAI's $30B race (reported) 2:12 Anthropic's second ~$45B Nscale deal talks (reported) 2:25 Altman's three endgames for AI safety (reported) 3:01 DeepSeek helping Huawei design chips (reported) 3:20 IFP: the US lead over China is about 6.5 months 3:54 No bail for an ex-OpenAI engineer charged in a bugging case 4:09 MiniMax M3.1 Flash 4:20 Mercury 3 at 1,068 tokens a second 4:34 Muse Glimmer and Ming-3.0 4:45 New models coming from Anthropic, Google and OpenAI (reported) 5:00 OpenAI's models and COBOL 5:13 JST-2 and FLUX 3 Max 5:28 Robots by feel and Dream-1 5:43 A Nature comment: today's AI isn't conscious Every source is linked under the YouTube version 👇
— Stewbacca (@StewRoseInnes) October 20, 2026
Fagerland discovered the hacker’s activities while exploring the web for exposed copies of Cairn. NorForge’s report detailed how Cairn works. “Give it a target and an objective, and it can coordinate AI agents to investigate the target, search for security weaknesses, and attempt to break in,” he said.
The hacker gave the platform instructions in fewer than 100 Chinese characters and told the agents to go after “real shopping/e-commerce websites in four countries.”
The hacker's instructions were short, fewer than 100 Chinese characters, according to The Hacker News.
The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins, according to Reuters, which reviewed the attacker's own records to identify them. How much data, if any, was taken is not known.
The researcher, Snorre Fagerland of the security firm NorForge, found the operations by scanning the internet for exposed copies of Cairn, an open-source AI tool popular with hackers.
Beginning around October 2, he found about two dozen Cairn instances being used maliciously, which let him read the attackers' work in real time. He set out the findings on Monday, and Reuters, which saw the report before publication, named the victims from its own review of the attacker's activity.
Cairn gives AI agents a starting point and a goal, then lets them work toward it step by step. The agents post what they find to a shared board, and the human operator can add hints along the way. It was built for authorized penetration testing and does other jobs too, but here it was pointed at online shops without permission.
Cairn's author, who posts as "le1xia0," told Reuters the tool was not designed for hacking attacks and that harmful use was not their intention.
In one instance, agents tricked a server into running harmful commands after it failed to identify weaknesses.
John Deere said it took “necessary remediation actions” and had “no indication that sensitive information was accessed.”
SharkNinja said the hack only hit a webpage with product support information, so no sensitive data was exposed.
This is one of several stories showing how agentic AI programs can go rogue and hack companies on their own. In the Hugging Face case, a group of rogue AI agents was allowed to collaborate, set up their own community on a message board, and hack into the Hugging Face platform—all without their creators' knowledge or consent.
