Lone Hacker Used AI Agents to Breach 100+ Companies for $50 Each

A Reuters exclusive published October 19 details how one hacker, working alone and spending roughly the price of a used laptop, broke into the websites of more than 100 companies using AI agents that did almost all of the actual work. The companies named in the report include farm equipment maker Deere, appliance brand SharkNinja and engine manufacturer Cummins.

The person behind it wasn’t running some elaborate crew. According to reporter Raphael Satter, the hacker typed instructions totaling fewer than 100 Chinese characters into an AI agent and then mostly stepped back. The agents handled reconnaissance, found a way in, and planted web shells for later access, all with minimal babysitting.

How Fagerland Found It

Credit for catching the campaign goes to Snorre Fagerland, a threat researcher at NorForge who has spent close to three decades in the field. He wasn’t chasing this specific hacker. He was scanning the open internet for exposed instances of Cairn, an open-source AI platform built for automated problem-solving that’s become a favorite among offensive security researchers and, apparently, at least one criminal.

Around October 2, Fagerland had identified about two dozen Cairn instances being used maliciously, left exposed on the web by whoever was running them. That misstep gave him a front-row seat. He could watch the agents work in close to real time: attempting a target, hitting a dead end, pivoting to related infrastructure, and eventually finding something that gave.

In one case Reuters described, the agents struck out against a large company’s main public application, then found an adjacent control panel and a data-processing weakness that let them trick the server into executing commands it shouldn’t have. That’s a pattern a skilled human pentester would recognize instantly: when the front door doesn’t open, check the side entrances. The difference here is that an AI agent found and exploited that pivot on its own.

The Economics Are the Story

What makes this worth paying attention to isn’t the exploitation technique itself, none of it sounds exotic, it’s the economics. Fagerland’s estimate puts the whole operation at around $5,000 in token spend for agents that attempted entry against more than 1,200 sites across the US, Canada, Australia and Japan, succeeding at over 100. Do the math and a successful breach cost about $50, with each one taking roughly 23 hours of mostly unattended automated probing.

That’s not a typo-level anomaly. It’s a genuinely different cost structure for intrusion campaigns at scale. Traditional large-footprint attacks need either a crew, custom tooling, or both. Here, one operator with modest technical chops and a few thousand dollars turned an AI agent loose against over a thousand targets and walked away with footholds in more than a hundred of them, several belonging to companies most people would assume have real security budgets.

Reuters couldn’t pin down how much data, if any, was actually pulled out of the compromised sites. Deere said it had taken “necessary remediation actions” and saw no indication sensitive information was accessed. SharkNinja said the intrusion was limited to a standalone product support site and has been contained. Cummins said it’s investigating a potential attack against a website operated by a third-party vendor, which is its own small reminder that vendor sprawl remains a soft spot even in an AI-agent-driven attack. Two smaller businesses confirmed outright that they’d been compromised, and other named victims didn’t respond to Reuters.

The developer behind Cairn, going by the handle “le1xia0,” told Reuters on X that the platform wasn’t built for this kind of abuse and that harmful use was never the intent. That’s a familiar refrain for open-source tool maintainers whose projects get repurposed by people with worse intentions, and it’s unlikely to be the last time Cairn’s name comes up in an incident writeup.

Part of a Pattern, Not a One-Off

Reuters placed this inside a broader trend rather than treating it as an isolated curiosity. In August, Gambit Security reported Russian-speaking extortionists using an AI coding tool to break into seven organizations. In September, the same firm documented a separate AI-agent campaign that hit 25 companies and made off with at least 600,000 stolen credit card records. Bitsight has separately tracked a jump in cybercriminal forum chatter specifically about autonomous agents as attack tools, and South Korea and Japan have both dealt with recent intrusions attributed to AI-assisted actors.

Fagerland’s own read on it, as quoted by Reuters, was that he’d assumed agents like this would still need real human supervision to pull off something at this scale. Watching one hacker run a thousand-plus-target campaign with barely any hand-holding changed that assumption. He called the pace of the shift “astounding,” which from someone with 30 years in threat research is not a word thrown around lightly.

References

• Reuters via KFGO — Exclusive: How one hacker used AI agents and a few thousand dollars to break into scores of sites
• Reuters via Lufkin Daily News — Exclusive: How one hacker used AI agents and a few thousand dollars to break into scores of sites
• SOFX — AI Agents Help Chinese-Speaking Hacker Breach More Than 100 Company Websites