Image: NorForge

A Chinese-speaking hacker broke into the websites of more than 100 companies, including farm equipment maker Deere, appliance brand SharkNinja and engine maker Cummins, while doing almost none of the work, according to a Reuters investigation. AI agents did the probing and the breaking in.

Reuters based its report on research by Snorre Fagerland of security firm NorForge, who found about two dozen criminal control panels for Cairn, an open-source AI agent platform, left open on the internet. Reuters identified the victims itself by reviewing the hacker's activity in those panels.

According to Reuters, the hacker started on September 25, aiming agents at online shops in the US, Canada, Australia and Japan with instructions of fewer than 100 Chinese characters. By late last week the agents had tried more than 1,200 sites. A successful break-in typically took about 23 hours, and Fagerland estimated the whole campaign used roughly $5,000 of AI tokens, or about $50 per successful hack.

Image: NorForge

That $50 figure holds up against NorForge's own report. It puts the average attempt at around $5 and the success rate at roughly 10%, so most of the money goes on failures. Even so, the price is tiny. In the "vibe hacking" case Anthropic described in 2025, ransom demands sometimes topped $500,000. That's at least 100 times this entire campaign's AI bill.

The bigger change is how little the human did. In that 2025 case, Anthropic said people were still very much directing the work. Its later report on a Chinese state-backed group found AI doing 80 to 90% of an espionage campaign against about 30 targets. Here, a lone criminal pointed agents at more than 1,200.

The "Claude Code" detail needs care. Reuters said the campaign appeared to use a mix of DeepSeek and Anthropic's Claude Code. NorForge says every task ran on a worker named "claudecode_deepseek-v4.1-flash", which could mean Anthropic's coding tool running DeepSeek's cheap V4.1 Flash model. If so, much of the thinking may never have touched Anthropic's servers. Anthropic itself has said it only sees what happens on Claude.

There are limits too. Reuters couldn't establish how much data was taken. Deere said it had "no indication that sensitive information was accessed." SharkNinja said only a standalone support site was hit, and Cummins said it was investigating a site run by a third-party vendor. Many outcomes in the panels are the agents' own claims, though NorForge confirmed at least one by finding a live web shell. The attackers were sloppy too: their open panels leaked hundreds of passwords and keys, which is how NorForge spotted them.

Still, these weren't elite targets. NorForge says the hacker went after mid-sized shops and tested that each could take orders before attacking. In one case it describes, the agents got in through an exposed session store and old Zend Framework code. The goal was to plant a hidden upload tool for later use. Security firm ReliaQuest reported a similar Cairn-linked takeover earlier this month that needed no new malware and no unknown flaw.

What site owners should do

• Update your shop platform and plugins, and retire old components you no longer need.
• Check upload folders for script files you didn't put there.
• Keep admin panels, caches and job dashboards off the open internet, or behind a login.
• Ask any agency or vendor that runs a site under your name how they patch it.

Cairn's creator said in a post on X that the platform "was not designed for hacking attacks," Reuters reported. Fagerland's view is blunter: "It's a new world now."