Hacker used AI agents costing about $5,000 to breach 100+ organizations, researcher says

A Chinese-speaking hacker handed almost all of the work of a breach spree to AI agents, and a researcher says the result was more than 100 compromised organizations, including Deere, SharkNinja and Cummins. Snorre Fagerland, principal threat researcher at the cybersecurity company NorForge, laid out the case in a report provided to Reuters ahead of publication on Monday.

According to Reuters, the hacker tasked AI agents with spending hours autonomously probing and breaking into target sites. A Techmeme summary of the Reuters story puts the total spend at roughly $5,000 to target 1,200+ websites.

How a researcher watched it happen

Fagerland found the hacker while scanning the web for inadvertently exposed instances of Cairn, an open-source AI problem-solving platform that Reuters describes as popular with hackers. Beginning around October 2, he found about two dozen instances being used for malicious activity. The Chinese-speaking hacker was one of several.

The campaign itself is older than the observation. Reuters reports the hacker started pointing AI at US, Canadian, Australian and Japanese e-commerce websites on September 25, about a week before Fagerland's count begins. The reporting does not say how the earlier activity was reconstructed.

The others on Cairn were not subtle about their goals. One stole a trove of credit card data. Another tried to get AI agents to rob a cryptocurrency exchange.

The numbers, and the two different prices

Kommersant, citing the company, reports that since September 25 the agents tried to break into more than 1,200 sites across the four countries. A single successful breach took about 23 hours and cost approximately $50. The hacker's instructions fit in fewer than 100 Chinese characters. Kommersant also reports that DeepSeek and Claude Code were used in the attacks.

That gives two price tags: $5,000 for the whole campaign, $50 for one successful hack. They are not in conflict. The figures describe different measures, and neither account provides a breakdown of spending on successful and failed attempts.

Here is what the numbers do not include. There is no success rate with a methodology behind it, only attempts (1,200+) set against breaches (100+). There is no definition of "breach" that holds across all the victims. And there is no count of how many attempts the targets noticed.

What the companies say

The three named companies describe three very different situations.

• Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed."
• SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained.
• Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors."

Notice the pattern: a remediated site, a contained support page, a vendor's website. None of the statements describe a core system. That is reassuring if you are a shareholder. The uncomfortable part for security teams is the combination: agents working autonomously for hours, with Kommersant reporting about 23 hours for a successful breach.

What it means, and what to watch

Fagerland's own summary was short: "It's a new world now." The substance behind it is that commercial AI agents can carry out complex intrusions end to end without a human steering. Fewer than 100 characters of instructions started one successful breach, according to Kommersant. A very short instruction manual for a very long day.

The open questions are large. The reporting does not identify the hacker or their location, name the other breached organizations, or establish whether sensitive user or company data was taken from the other affected sites. Nor does it say whether the developers of DeepSeek, Claude Code or Cairn have added guardrails against this kind of autonomous attack.

Watch for a fuller victim list, any disclosure of what data was actually reached, and responses from the tool makers. Until then, this is one researcher's account of one campaign, relayed through Reuters. Show me the eval, not the vibe: a published method for counting these breaches would be worth more than another $5,000 headline.