# One hacker set AI agents on 1,200 websites, and they broke into Deere and SharkNinja
> Source:
> Published: 2026-10-19 13:03:00+00:00
A staged photo of a gloved hand at a laptop showing a "hacked" screen (illustrative). Image: [Yuri Samoilov]() / Wikimedia Commons, [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/), cropped
A Chinese-speaking hacker handed a hacking campaign almost entirely to AI agents, which tried to break into more than 1,200 shopping websites in the US, Canada, Japan and Australia and got into scores of them. The security firm NorForge [laid out the operation in a report](https://norforge.com/blog/inside_cairn) on Monday, after finding the attackers' own control panels sitting open on the internet.
The agents ran on Cairn, an open-source "problem-solving" platform that coordinates teams of AI workers towards a goal. NorForge found more than 20 exposed Cairn panels it judged likely to be malicious, which let its researchers watch criminals pick targets, brief their agents and log each break-in as it happened.
## A few lines of instructions, then 23 hours of hacking
The busiest group, which NorForge labels AIA0001, wrote its tasks in Chinese and ran more than 1,100 attack projects across 14 dashboards. A typical brief, translated in the report, described "confirmed real shopping/e-commerce websites" with 200,000 to 1.5 million visitors, already checked by a script to make sure orders could be placed. The goal was remote code execution, and the payload was a small file-upload "shell" that gives the attacker a way back in later.
NorForge says roughly 10% of tasks reached their goal, with many more partly succeeding. Successful break-ins took a little under 23 hours on average, and one project ran for more than five days. To test the agents' claims, the researchers fetched a shell address listed in a finished task against a large hardware parts vendor: the shell was really there.
Reuters, which [reviewed the hacker's Cairn data](https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html) alongside NorForge, identified victims including farm equipment maker Deere, home appliance company SharkNinja and engine maker Cummins. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed". SharkNinja said a standalone product-support site was hit and the threat contained, and Cummins said it was investigating a possible attack on a site run by a third-party vendor. Reuters said it could not tell how much data was taken.
## Cheap models doing expert work
Every AIA0001 task NorForge saw was run by a worker called "claudecode_deepseek-v4.1-flash", which the report reads as Anthropic's Claude Code agent tool driving DeepSeek's low-cost V4.1 Flash model. NorForge estimates an average task cost about $5 in tokens, though long projects could pass $100. Snorre Fagerland, NorForge's principal threat researcher, put the whole campaign at roughly $5,000, or about $50 per successful hack, he told Reuters.
He was struck by what the agents worked out on their own. In one case, after finding nothing wrong with a big company's main application, they tracked down a related control panel, spotted a subtle flaw in how it handled data and, after hours of trial and error, used it to run commands on the server. Fagerland told Reuters:
It's not straightforward to come up with solutions like that. It's not script kiddie stuff.
Snorre Fagerland, principal threat researcher, NorForge
The report also found the set-up had been borrowed from a Tencent hacking competition: one agent noted it was running inside a "tsec CTF" environment. NorForge says this is almost certainly criminals reusing tools and there is no reason to think Tencent was involved.
A second, English-speaking group gave its agents briefs as blunt as "fetch credit cards" or "fetch crypto" and let them work out the rest, using DeepSeek models through OpenRouter. Reuters reports one hacker stole a trove of card data and another tried to get agents to rob a cryptocurrency exchange.
## The hackers forgot to lock their own doors
The panels were open to anyone. Scanning their data, NorForge found hundreds of passwords, keys and other secrets, 11% of them confirmed as still valid, and full admin controls that could in principle restart projects or point the agents at new targets. Some legitimate penetration testers had also left client work exposed the same way. NorForge says it is working with Reuters to notify victims and trying to get the panels taken down.
Cairn's author, who posts as "le1xia0", said on X that the platform "was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention."
It is the latest sign of AI agents moving from lab demos into real crime: earlier this month, [four South Korean banks were hit](https://madrobot.blog/2026/10/02/south-korea-banks-shinhan-kb-kookmin-hana-hacked-ai-tool-artex-suspected/) with a Chinese AI hacking tool suspected, and hackers who [may have used AI agents stole data on nearly a million members](https://madrobot.blog/2026/10/07/yoido-full-gospel-sarang-church-data-breach-ai-agent-hack/) of a Seoul church. Researchers have also [caught agents probing government sites](https://madrobot.blog/2026/10/01/ai-agents-tried-to-hack-library-archives-canada-transluce-us-government-websites/) on their own.
## Why it matters
A single attacker with a short brief and a few thousand dollars of cheap model time ran a campaign that would once have needed a skilled team. Fagerland told Reuters he had assumed hacking agents would still need some supervision, and that the technology has clearly moved past that: "The development in this field is astounding."
*Sources: [NorForge, "Inside Cairn: Open Windows into massive AI-Driven Cyber Operations"](https://norforge.com/blog/inside_cairn); [Reuters](https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html) (victims, company responses and Fagerland interview).*