One hacker used AI agents to break into more than 100 company websites, Reuters reports

Reuters says a hacker using agents on the open-source Cairn platform breached websites of 100+ companies, including Deere, at about US$50 per intrusion.

20 October 2026

What Reuters found

A single hacker broke into the websites of more than 100 companies while leaving nearly all of the work to AI agents, according to an exclusive Reuters report published on 19 October. Reuters' Raphael Satter reported that the campaign began on 25 September and targeted e-commerce sites in the United States, Canada, Australia and Japan. By late last week the agents had attempted more than 1,200 sites.

The activity was found by Snorre Fagerland, principal threat researcher at the security firm NorForge. He was scanning the web for exposed instances of Cairn, an open-source multi-agent problem-solving platform, and from about 2 October found roughly two dozen instances being used for malicious activity. According to Reuters, this campaign appeared to use a mix of the Chinese model DeepSeek and Anthropic's Claude Code. The article did not include comment from Anthropic or DeepSeek.

Cost and speed

Reuters' figures suggest these intrusions are now cheap to run:

the hacker's instructions were short, under 100 Chinese characters
successful intrusions took about 23 hours on average, with agents probing targets on their own for hours
total token costs were roughly US$5,000, or about US$50 per successful hack

Fagerland told Reuters he had assumed such agents would still need some supervision, but that the technology had clearly moved past that.

Victims and responses

Fagerland's report did not name victims. Reuters identified them by independently reviewing the hacker's Cairn activity. They included farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins.

Deere said it had taken necessary remediation actions and had no indication that sensitive information was accessed.
SharkNinja said the breach affected a standalone product support site and had been contained.
Cummins said it was investigating a potential attack on a website run by a third-party vendor.

Two smaller businesses acknowledged being compromised, and the other victims did not respond. Reuters said it could not determine whether data had been taken.

Cairn's author, known online as le1xia0, did not answer Reuters' questions. In a post on X cited by Reuters, the author said Cairn was a multi-agent architecture not designed for hacking and was not meant to be used that way.

Part of a wider pattern

The report adds to a series of researcher accounts of criminals using agents. Fagerland told Reuters he had also seen one hacker steal a large set of credit card data and another try to use agents to rob a cryptocurrency exchange. In one intrusion, agents found no weaknesses in a large company's public-facing app, so they moved on to related infrastructure, found a control panel and exploited a subtle data-processing flaw to run commands.

In September, Gambit Security described a campaign in which a single operator writing in Chinese used three open-source agents, one of them Cairn, to breach at least 27 companies and copy more than 600,000 credit card records, according to The Next Web. Gambit called its findings an interim assessment, and The Next Web said it had not independently verified them. Reuters also cited Bitsight as saying that discussion of autonomous agents is surging on cybercriminal forums.

Why it matters

This is different from the evaluation incidents in which lab agents strayed beyond their tasks. Here a person deliberately pointed agents at targets. What the two kinds of case share is how little human effort is needed once an agent has a goal and network access.

So far, findings like these come mostly from individual security firms, and none of the named companies has reported confirmed data loss. Reuters' account rests on Fagerland's research and its own review of the hacker's activity.