Hacker Used AI Agents to Breach Over 100 Corporate Sites for $50 Each

How autonomous agents did the dirty work

The attacker gave high-level prompts under 100 characters and let an open-source framework automate multi-hour intrusion attempts.

Cybersecurity researcher Snorre Fagerland from NorForge uncovered the operation after tracking publicly exposed instances of Cairn, an open-source autonomous problem-solving engine. While Cairn is a neutral automation platform meant to complete multi-step software tasks, this operator configured it to solve a singular problem: executing arbitrary code on remote servers without valid credentials.

Equipped with model pairings that Fagerland suspects included Claude Code alongside a DeepSeek model, the agents tested for traditional flaws like SQL injection, file upload vulnerabilities, and object handling errors. The prompts guiding the system were remarkably brief, often spanning fewer than 100 Chinese characters. From there, the autonomous agents hammered target sites for an average of 23 hours before either executing an exploit or dropping the domain to move on to the next.

Over four weeks, the attacker aimed the setup at roughly 1,200 web properties, successfully breaking into over 100. That works out to roughly $50 worth of compute tokens per breach, turning enterprise compromise into a bulk, commoditized operation.

Big brands caught in the dragnet

The operation swept up online stores and corporate domains across the United States, Canada, Australia, and Japan. Follow-up investigations verified through the hacker's active Cairn activity that agricultural titan Deere, household appliance firm SharkNinja, and engine maker Cummins were among the targets.

Deere told Reuters that it enacted remediation measures and saw no signs that sensitive customer data had been accessed. SharkNinja stated the affected system was an isolated portal handling product support information that was quickly patched. Cummins acknowledged the activity and noted it was reviewing the reports.

The breaches illustrate a core challenge that security researchers have flagged for months: AI agents cannot be trusted to police themselves, and attackers have zero qualms about turning that open autonomy loose against vulnerable infrastructure.

When brute persistence beats expert human exploiters

What worried investigators most was not that the models discovered zero-day vulnerabilities, but how efficiently they navigated dead ends. In one instance detailed by Fagerland, after an agent failed to exploit a primary web target, it mapped the organization's adjacent infrastructure, located an exposed control panel, and spent hours experimenting with how the panel parsed data until it triggered remote command execution.

The goal appears to have been establishing long-term persistence across payment platforms and online stores rather than immediate extortion. Fagerland discovered hundreds of exposed corporate credentials and secrets left visible across the hacker's open panels, which researchers are actively cataloging to notify affected organizations.

What it means for you

Consumers using services from Deere, SharkNinja, or Cummins do not need to take immediate action, as there is no evidence yet that consumer financial data or personal credentials were stolen. However, customers who maintain account logins across manufacturer support portals should monitor those accounts for unusual activity.

For IT teams managing enterprise web infrastructure in North America, Europe, and Asia, the incident serves as an urgent reminder to audit public-facing administrative portals, patch known web application vulnerabilities, and review directory structures for unauthorized script drops.

As offensive toolkits transition from simple automated vulnerability scanners to adaptive reasoning engines, enterprise attack surfaces face an entirely new volume problem. Securing obscure secondary domains and administrative control panels has instantly become far more urgent.