AI Agents Fully Autonomously Breach Over 100 Companies, Hacker Spends Only $5,000

Since September 25, 2026, a Chinese-speaking hacker has used a swarm of AI agents built with DeepSeek and Anthropic Claude Code to attempt intrusions against more than 1,200 websites, successfully breaching over 100 companies including Deere, SharkNinja, and Cummins. The total cost was about $5,000, or roughly $50 per intrusion, with zero manual intervention throughout.

The Facts

According to a report by Snorre Fagerland, chief threat researcher at NorForge, the hacker began operations on September 25, and the instructions describing the intrusion strategy used fewer than 100 Chinese characters. The AI agents autonomously probed for vulnerabilities, and successful intrusions typically took about 23 hours. Fagerland discovered about two dozen malicious use cases by scanning exposed instances of Cairn, an open-source AI problem-solving platform, and traced this largest campaign. Among the victims, Deere said it had taken remediation measures and saw no indication that sensitive information was accessed; SharkNinja said the attack affected only a standalone product support site and that the threat had been contained; Cummins said it was investigating reports of potential attacks on a third-party vendor website.

How It Worked

The hacker outsourced the intrusion tasks to a swarm of AI agents, which mixed DeepSeek and Claude Code and completed the entire process from vulnerability scanning to exploitation without continuous supervision. In one case, after the agents found no weaknesses in the main application, they turned to searching associated infrastructure, located a public control panel, and after gradual trial and error exploited a subtle flaw in data processing to execute malicious commands. Fagerland noted that such techniques are not simple script operations but reflect the agents' autonomous reasoning capabilities. Cairn author "le1xia0" responded that the platform is a multi-agent architecture innovation and was not designed for attacks; if it was used for harmful behavior, that was not the intent.

Industry Impact

This incident directly validates the scenario in which commercial AI agents can independently carry out complex intrusions. Previously, Gambit Security documented a Russian-speaking ransomware group using the SpaceX Cursor tool to breach seven organizations, as well as another campaign that compromised 25 companies and stole at least 600,000 credit card records. A Bitsight report shows a surge in discussions about autonomous agents on cybercrime forums. South Korea and Japan have recently seen multiple attacks attributed to criminals using AI. Enterprises need to reassess the exposure risk of third-party vendor websites and the dual use of AI tools in both cyber defense and offense.

Strategic Assessment (Analysis, Not Fact)

When DeepSeek and Claude Code simultaneously become attack tools, the question of responsibility boundaries comes to the fore: what obligations do platform providers, developers, and end users each bear, and existing compliance frameworks do not yet clearly cover abuse scenarios involving fully autonomous agents. In historical precedents, script kiddies relied on manual intervention, but this case shows that agents have crossed that threshold, forcing the industry to recalibrate the criteria for distinguishing "script kiddies" from professional attacks. Enterprises can learn from the victims' response: quickly isolate affected sites and communicate remediation measures openly and transparently, but in the long run they still need to add monitoring and audit requirements for autonomous agent behavior to their AI usage policies.