Chinese hacker hits over 100 company websites using AI agents — Deere and SharkNinja among top brands affected in attack

A hacker used AI agents to target more than 1,200 websites, compromising over 100 in under a month Autonomous agents tested vulnerabilities, adapted tactics, and established access with minimal human input Researchers warn AI-powered attacks are making large-scale website compromise faster and cheap

<![CDATA[ <article> <ul><li><strong>A hacker used AI agents to target more than 1,200 websites, compromising over 100 in under a month</strong></li><li><strong>Autonomous agents tested vulnerabilities, adapted tactics, and established access with minimal human input</strong></li><li><strong>Researchers warn AI-powered attacks are making large-scale website compromise faster and cheaper</strong></li></ul><p>In less than a month, a single Chinese hacker managed to break into more than 100 company websites, while doing almost none of the work himself. Instead, he tasked AI agents to do it for him and paid them around $5,000 in tokens for the job.</p><p>The campaign was spotted by cybersecurity researcher Snorre Fagerland from NorForge, who was looking for exposed Cairn installations when he found approximately two dozen being used for malicious purposes. These gave him first-hand insight into an active cybercriminal operation. </p><p>Cairn is described as an open source, general-purpose AI problem-solving engine, designed to help autonomous agents find solutions to complex tasks. Instead of focusing on a single application, Cairn provides a framework that defines goals, explores different approaches, and then executes actions to try and solve the problem. According to numerous media outlets, Cairn is quite popular in the cybercriminal community (although it’s not malicious by design). </p><h2 id="when-security-becomes-a-problem-needing-solving">When security becomes a problem needing solving</h2><p>In this case, the “problem” Cairn was trying to solve for the attacker was how to run code on a website without signing in. They were trying out SQL injection, file uploads, as well as unsafe handling of stored objects. The goal, according to the researcher, was to establish persistent access to shopping and <a href="https://www.techradar.com/best/best-payment-gateways" target="_blank">payment systems</a> which could later be used to steal money. </p><p>Fagerland said the attacker used a combination of models, likely Claude Code with a DeepSeek model, although it is very difficult to determine. The instructions themselves were very brief, generally fewer than 100 Chinese characters, and in less than a month, the agents tried to break into more than 1,200 sites. </p><p>On average, the agents poke around a website for a day (23 hours), before either breaking in or moving on. With some 100 successful break-ins, Fagerland says the hacker paid $50 for tokens on average, per breach. This, however, is an estimate and not a confirmed billing.</p><p>The analyst did not name the victims. In its report, Cybersecurity News said the victims were mainly online stores in the United States, Canada, Australia and Japan, and Reuters managed to confirm some targets by “independently reviewing the hacker's Cairn activity”: including Deere (farm equipment maker), SharkNinja (home appliance ​company), and Cummins (engine manufacturer). It added that two “smaller businesses” also acknowledged being compromised but did not reply to the agency’s inquiries. </p><h2 id="impressive-technique">Impressive technique</h2><p>Deere told <em>Reuters</em> it took “necessary remediation actions” and added that there was “no indication that sensitive information was accessed.” SharkNinja said the breach hit a standalone site carrying product support information only, and that the threat had been remediated. Cummins just said it was looking into reports.</p><p>So far, no one knows if the attacker managed to steal any sensitive data from his victims, and if so - how many. The researcher apparently found “hundreds” of exposed secrets in the open panels and was working with Reuters to let the victims know. </p><p>Fageraland told Reuters he was “impressed” by some of the techniques the agents used while compromising their victims. Apparently, after hitting a dead end against one of the targets, the <a href="https://www.techradar.com/best/best-ai-tools" target="_blank">AI agents</a> scanned digital records in search of associated infrastructure. When they found a public-facing control panel, they discovered a “subtle weakness” in how it processed data. It took “hours of trial and error” before finally being able to execute a malicious command on the website’s server. </p><p>"It's ⁠not straightforward to come up with solutions like that," Fagerland said. "It's not script kiddie stuff."</p><p>AI attackers are the new normal, it seems. Business owners are advised to patch public-facing applications, restrict access to admin panels, and keep an eye on unexpected files in web directories.</p><p><em>Via </em><a href="https://www.tomshardware.com/tech-industry/artificial-intelligence/a-chinese-hacker-used-ai-agents-to-break-into-more-than-100-company-websites-deere-and-sharkninja-among-websites-hit-by-open-source-ai-powered-problem-solving-platform-demo" target="_blank"><em>Tom's Hardware</em></a></p> </article> ]]>