One Hacker’s AI Agents Breached 100+ Company Sites — for Just $5,000

A $50 break-in, automated end to end

A Chinese-speaking hacker used autonomous AI agents to break into the websites of more than 100 companies — including Deere, SharkNinja and Cummins — spending an estimated $5,000 in AI tokens on the whole campaign, Reuters reported Monday. That works out to roughly $50 per successful break-in, cheaper than a single hour of a junior penetration tester’s time.

The campaign was uncovered almost by accident. Snorre Fagerland, principal threat researcher at cybersecurity firm NorForge, was scanning the internet for exposed installations of Cairn, an open-source platform that coordinates AI agents to carry out tasks with minimal human guidance. By early October he had found about two dozen such panels sitting wide open — and realized some were being used to run an attack campaign, which he documented in a report shared with Reuters.

What happened

According to the Reuters investigation, as covered by CyberSecAsia, AI Weekly and others:

• The scale. Starting September 25, 2026, the operator’s agents attempted to intrude on more than 1,200 websites — mostly online stores in the United States, Canada, Australia and Japan — and successfully broke into more than 100 of them.
• The instructions. The attacker’s brief fit in fewer than 100 Chinese characters: find a way to run commands on each site’s server, then plant a hidden “uploader” web shell for later access. From there, the agents worked unsupervised — probing targets, searching for weaknesses and trying to get in, with almost no further human direction.
• The pace. A successful intrusion took about 23 hours of automated probing. Most of that was patience: the agents tried doors, read documentation and shared what they learned across attempts.
• The cost. NorForge estimates about $5 in AI usage per attempt; at roughly one success in ten, that is around $50 per break-in and about $5,000 for the entire spree. The campaign reportedly ran on DeepSeek and Anthropic’s Claude Code.
• The victims. Reuters independently identified Deere, SharkNinja and Cummins among the breached companies. Deere said it took “necessary remediation actions” and saw no sign that sensitive information was accessed; SharkNinja said the affected site held only product-support information; Cummins said it was investigating a possible attack on a vendor-run site. Reuters could not determine how much data, if any, was taken.

Why it matters for your small business

This is the clearest proof yet that automated attacks have scaled down-market. The target list was not banks or governments — it was ordinary online stores, the same kind of WordPress or WooCommerce sites that small businesses run every day. A lone operator with no team and no sleep schedule turned a $5,000 token budget into a breach campaign that once would have required a crew of skilled hackers.

Three takeaways for SMB owners:

1. Attack economics now favor the attacker. At roughly $50 per successful intrusion, defending your site is no longer competing against bored teenagers — it is competing against tireless software that can try hundreds of doors while you sleep. Basic hygiene (patched plugins, strong admin credentials, backups) is now the minimum viable defense, not best practice.

2. Agents cut both ways. The same technology that lets AI agents draft your marketing copy or reconcile your books can be pointed at your infrastructure — by criminals, or accidentally by your own misconfigured tools. If you run agents in your business, treat them like new employees with system access: least privilege, audit trails, and a human in the loop for irreversible actions.

3. The industry is responding with agent policing. Just as this campaign surfaced, Microsoft announced new security controls for Microsoft 365 E7 and Project Perception that continuously score each agent’s risk and can revoke its ability to make changes, require human approval or shut it down entirely. Microsoft’s new “Guardian Agents” investigate why an agent’s risk changed and help contain it. Expect agent governance to become a standard line item in business software within a year.

What to do next

No new product to buy here — this is a threat story. But there is a concrete checklist:

• Update everything this week. Most website intrusions exploit known vulnerabilities in outdated plugins, themes and CMS cores. An unpatched site is the unlocked door in this story.
• Add a web application firewall (WAF). Cloudflare’s free plan and similar services filter the kind of automated probing these agents run. It takes about an hour to set up.
• Back up and test the restore. If an attacker plants a web shell, a clean backup is your fastest recovery path.
• Lock down admin access. Unique admin usernames, two-factor authentication, and IP or country restrictions on login pages where possible.
• Audit your own AI agents. If your team uses coding agents, browser agents or automation tools like the ones in the OpenCode breach case, review what credentials they hold and whether they can act without approval. Rotate any key that has ever been shared or pasted into a chat.

The uncomfortable math of this story is simple: attacks got cheap, patient and scalable. Your defenses do not need to be perfect — they need to make your site a harder target than the next one on the list.

FAQ

Was my small business website likely targeted?
Probably not specifically — but the campaign hit ordinary online stores across four countries, not handpicked victims. Any internet-facing store running unpatched software is in the candidate pool for this class of attack.

Which AI models did the attacker use?
NorForge’s report indicates the campaign used DeepSeek and Anthropic’s Claude Code. The key point is that the tools were commercial, off-the-shelf AI agents — not bespoke government malware.

Can AI agents be used defensively too?
Yes. The same agent capabilities are being productized for defense: Microsoft’s new Guardian Agents, for example, monitor other agents for risky behavior and can help contain them. Those controls currently ship in enterprise tiers (Microsoft 365 E7 at $99 per user per month), so most SMBs will get them later or via their IT provider.

Sources

• SofX on the Reuters report: https://www.sofx.com/ai-agents-help-chinese-speaking-hacker-breach-more-than-100-company-websites/
• CyberSecAsia: https://cybersecasia.net/news/researcher-reports-autonomous-ai-agents-breached-websites-belonging-to-more-than-100-firms/
• AI Weekly: https://aiweekly.co/alerts/hackers-ai-agents-breached-100-sites-at-50-each-norforge-says
• GeekWire on Microsoft’s agent controls: https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/
• Unite.AI on Guardian Agents: https://www.unite.ai/microsoft-adds-guardian-agents-to-project-perception-for-ai-insider-risk/