For years, security experts warned that AI would one day let a single criminal do the work of an entire hacking crew. A new Reuters investigation suggests that day has arrived. According to the report, published October 19, one Chinese-speaking hacker broke into websites belonging to more than 100 companies while doing almost none of the hands-on work. AI agents did it instead.

Here’s what the researcher saw, how the attacks worked, and why this story matters well beyond the companies that were hit.

What happened

The details come from Snorre Fagerland, principal threat researcher at the cybersecurity company NorForge. As Reuters reported, Fagerland was scanning the internet for exposed copies of Cairn, an open-source AI problem-solving platform that has become popular with hackers. Starting around October 2, he found about two dozen instances being used for malicious activity. Because those copies were left exposed, he could quietly watch the criminals as they put their AI tools to work.

The most prolific of them was a Chinese-speaking hacker who, beginning September 25, aimed a fleet of AI agents at e-commerce websites in the United States, Canada, Australia and Japan. Reuters independently reviewed the hacker’s Cairn activity and identified victims including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins.

The numbers that stand out

What makes this case so striking isn’t just the number of victims. It’s how little effort and money it took.

  • Tiny instructions. The hacker sketched out their preferred tactics in fewer than 100 Chinese characters.
  • Huge reach. As of late last week, the agents had tried to break into more than 1,200 sites.
  • Patience instead of people. A successful intrusion typically took around 23 hours of automated probing for weaknesses.
  • Bargain-bin pricing. Fagerland estimated the campaign used roughly $5,000 worth of AI tokens, or about $50 per successful hack. He said it appeared to run on a mix of China’s DeepSeek and Anthropic’s Claude Code.

In other words, the expensive part of hacking, skilled human time, was largely replaced by computing time that costs less than a nice dinner per victim.

“Not script kiddie stuff”

It would be comforting to think the agents just ran crude, automated attacks. Fagerland, who has worked in cybersecurity for nearly 30 years, said otherwise. In one case, after failing to find any weakness in a large company’s public-facing application, the agents dug through digital records to find related infrastructure, located a public-facing control panel, spotted a subtle flaw in how it handled data and, after hours of trial and error, reported using it to make the server run malicious commands.

“It’s not straightforward to come up with solutions like that,” Fagerland told Reuters. “It’s not script kiddie stuff.”

He also said he had assumed AI hacking agents would still need some human supervision. What he saw convinced him the technology had moved past that.

How the companies responded

Reuters said it could not determine how much data, if any, was actually taken. Deere said it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the hack hit a standalone site that carried only product support information and that the threat had been contained, a point Tom’s Hardware also highlighted. Cummins said it was investigating a report of a potential attack on a website run by one of its third-party vendors.

Cairn’s author, who goes by “le1xia0” online, said in a recent post on X that the platform was “not designed for hacking attacks” and that harmful use was not their intention.

Other hackers Fagerland watched were busy too. One stole a trove of credit card data, and another tried to get AI agents to rob a cryptocurrency exchange.

Why this matters to everyone else

This isn’t an isolated case. Reuters pointed to other recent incidents, including AI-driven breach sprees documented by the Israeli firm Gambit Security and a surge in cybercriminal forum discussions about autonomous agents flagged by the intelligence company Bitsight. The bigger shift is economic. When an attack costs about $50 and needs no babysitting, criminals can go after far more targets, including small businesses that once weren’t worth the trouble.

For regular people and small site owners, the practical takeaways are familiar but more urgent:

  • Patch fast. AI agents are tireless at finding known, unpatched flaws. Keep websites, plugins, routers and apps updated.
  • Hide the control panels. Admin dashboards and test servers that face the public internet are exactly what these agents went looking for.
  • Use unique passwords and two-factor sign-in. If a site you use is breached, that limits how far the damage spreads.
  • Watch your statements. With card data among the targets, check bank and card activity regularly and report anything odd.

The takeaway

The Cairn spree is a preview of security in the agent era: attacks that are cheap, constant and surprisingly clever. The same AI tools can also help defenders find and fix weaknesses first, but only if organizations treat basic security hygiene as a daily habit. As Fagerland put it to Reuters, “It’s a new world now.”

Image: Code Coding by Lorenzo Cafaro via StockSnap, CC0 1.0