One Hacker's AI Agents Breached 100+ Company Sites for About $50 Each, NorForge Report Finds

A single Chinese-speaking hacker used AI agents to break into the websites of more than 100 companies over about two weeks, with the agents doing most of the work, according to a Reuters exclusive published on 19 October 2026. The security firm NorForge estimated the campaign cost about $5,000 in AI tokens, or roughly $50 per successful intrusion.

The findings come from Snorre Fagerland, principal threat researcher at NorForge, whose report Reuters saw before it was published on Monday.

What did the campaign do?

According to Reuters, the hacker began targeting e-commerce websites in the United States, Canada, Australia and Japan on 25 September. By late the previous week, the agents had attempted more than 1,200 sites. The operator's instructions were terse, under 100 Chinese characters, according to Reuters. Gizmodo reported that NorForge found some prompts as simple as "fetch credit cards" or "fetch crypto".

Successful intrusions typically took about 23 hours, Reuters reported, as the agents spent hours probing and retrying on their own. The Next Web reported that NorForge's Chinese-language cluster ran more than 1,100 attack projects across 14 linked control panels, using an automated pipeline that fed tasks to agents. Their goal was to run code on each site and plant an uploader web shell, apparently to keep lasting access to shop and payment systems. NorForge checked one claimed break-in at a large hardware parts vendor and found the web shell live, according to the same report.

Reuters described one case in which the agents found no weakness in a large company's public-facing application. They then located related infrastructure and a public control panel, and, after hours of trial and error, exploited a subtle data-processing flaw to make the server run malicious commands. "It's not script kiddie stuff," Fagerland told Reuters.

How did researchers see it?

The activity became visible because of a basic security lapse. The agents ran on Cairn, an open-source AI problem-solving platform that Reuters described as popular with hackers. Cairn takes a target and a goal and assigns agents to work toward it step by step; agents post findings to a shared board, and human operators can add hints, according to The Next Web. Many operators left their Cairn control panels open to the internet. Fagerland found them by scanning for exposed instances, and from around 2 October found about two dozen being used for malicious activity, Reuters reported.

NorForge judged more than 20 panels likely malicious and grouped them into three clusters, The Next Web reported. Besides the Chinese-language cluster, it found an English-language cluster of 10 linked panels whose agents were told to steal credit cards and cryptocurrency, and a single panel with 59 projects that NorForge rated malicious with low confidence. A scan of the panel data also found hundreds of credentials and API keys, 11% of which the tool Trufflehog verified as valid.

Who was hit, and what did they say?

Fagerland did not name the victims; Reuters identified them by reviewing the hacker's Cairn activity. Named companies include the farm equipment maker Deere, the home appliance company SharkNinja and the engine maker Cummins.

Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the incident hit a standalone website containing only product support information and that it had contained the threat. Cummins said it was investigating a potential cyberattack on a website run by one of its third-party vendors. The Next Web noted it had not independently verified the intrusions.

What do the numbers actually show?

The headline cost figure needs care. The roughly $5,000 and $50-per-hack numbers are Fagerland's rough estimates. NorForge's own report, as summarised by The Next Web, puts the average at about $5 per task once failed or abandoned attempts are counted, and says the uncertainty is considerable. NorForge estimated an average success rate of about 10% across the tools, while cautioning that the clusters had different goals and cannot be compared directly.

The sources also differ on scale. Reuters reported more than 100 compromised companies and more than 1,200 sites attempted. Gizmodo wrote that the effort compromised over 1,000 sites, which conflicts with that account and with a 10% success rate; this article uses the Reuters figures. Reuters said it could not determine how much data, if any, the intruders extracted.

On models, Reuters said the campaign appeared to use China's DeepSeek and Anthropic's Claude Code. The Next Web reported that every task ran on a worker named "claudecode_deepseek-v4.1-flash", which NorForge said could mean Claude Code driving DeepSeek's low-cost V4.1 Flash model.

Why does it matter?

The economics are the story. Intrusions that once demanded days of skilled manual work now cost, by Fagerland's estimate, tens of dollars each and run unattended. Fagerland told Reuters he had assumed hacker agents would need supervision, but that the technology had advanced beyond that. "It's a new world now," he said.

Reuters placed the campaign in a pattern. In August, the Israeli firm Gambit Security found Russian-speaking extortionists using an AI coding tool to break into seven organisations. In September, Gambit documented an agent-driven campaign that breached 25 companies and stole at least 600,000 credit card records; The Next Web said Gambit found Cairn on that attacker's server. Bitsight told Reuters that discussion of autonomous agents was surging on cybercriminal forums.

Cairn's author, who posts as "le1xia0" on X, did not answer Reuters' questions. In a post quoted by Gizmodo, the author wrote that Cairn "was not designed for hacking attacks" and that if it is used for harmful attacks, "that is not my intention."

What happens next?

NorForge is working with Reuters to warn victims and asking hosting providers to take exposed panels offline, according to The Next Web. The harder questions are for model providers and defenders. Providers that supply the underlying models face pressure to detect and block agentic intrusion workloads, while site owners face attackers that never tire and can afford to fail nine times in ten.

What we don't know yet

The hacker's identity and the volume of stolen data remain unknown. Whether the English-language and Chinese-language clusters are linked, and whether the Gambit campaign involves the same operator, has not been established in the sources reviewed. The model attribution rests on a worker name and Reuters' description rather than on confirmation from the model developers.