A Chinese-speaking hacker broke into websites belonging to more than 100 companies while leaving nearly all the work to AI agents, according to a Reuters exclusive published on Monday, October 19. Snorre Fagerland, principal threat researcher at NorForge, said he watched the agents attempt more than 1,200 sites across the US, Canada, Australia and Japan starting September 25.

The victims Reuters confirmed include farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins. Each successful intrusion took the agents about 23 hours, and Fagerland put the full bill at about $5,000 in tokens — roughly $50 per successful hack. The operator's instructions fit in fewer than 100 Chinese characters: find a way to run code on each site, then plant an uploader web shell.

The campaign ran on Cairn, an open-source AI problem-solving platform popular with hackers, under a worker string NorForge reads as Claude Code calling DeepSeek's V4.1 Flash model. Fagerland found it by scanning for inadvertently exposed Cairn panels — about two dozen malicious instances by October 2 — and Reuters independently examined the activity. "It's not script kiddie stuff," Fagerland told Reuters; the campaign was still running late last week, and how much data was taken remains undetermined.