One hacker, 1,200 targets: AI agents broke into around 100 companies in under a month

One hacker, 1,200 targets: AI agents broke into around 100 companies in under a month

Security researcher Snorre Fagerland was hunting for exposed installations of the Cairn agent framework — and found himself in the middle of an ongoing, autonomous hacking campaign. Around 100 of more than 1,200 targeted websites were, according to the researchers, actually breached, at an average cost of about $50 in token usage per successful intrusion.

Security researcher Snorre Fagerland of NorForge was looking for exposed installations of the Cairn framework when he found roughly two dozen being used for malicious purposes. The panels gave him first-hand insight into an active criminal operation: a single operator who set autonomous AI agents loose on more than 1,200 websites in under a month, and who, according to the research, succeeded in breaking into about 100 companies.

NorForge published the findings on October 19, 2026, and Reuters has since identified named victims — among them tractor maker Deere, home-appliance maker SharkNinja and engine maker Cummins — by independently reviewing the hacker's Cairn activity. The case is documented in secondary coverage of Fagerland's findings and Fortune's reporting.

Brief instructions, long execution

The campaign began around September 25, according to researchers who spoke with Reuters. What makes it remarkable is the ratio of human effort to autonomous execution: the instructions the operator gave the agents were extremely short, usually fewer than 100 Chinese characters. Once the agents were launched, no further input from the hacker was required — the agents worked independently throughout the attack.

Each successful intrusion was not fast. According to NorForge, the agents accumulated an average of around 140 investigation results in successful projects, and it took an average of just under 23 hours to reach the goal. These are slow, methodical attacks in which the agents dig their way forward rather than striking quickly.

Fagerland described an example of how the agents adapted along the way: after hitting a dead end at one of the targets, the agents went through digital traces looking for associated infrastructure. When they found a publicly accessible control panel, they discovered a "subtle weakness" in how the panel processed data. It took "hours of trial and error" before the agents finally managed to execute a malicious command on the website's server.

The goal, according to the researcher, was to establish persistent access to shopping and payment systems that could later be used to steal money.

The economics: around $50 per intrusion

The cost side may be the most striking. With roughly 100 successful intrusions, Fagerland estimates the hacker paid an average of $50 in tokens per successful breach. Total token spending is estimated at about $5,000 for the entire campaign.

It is important to stress what these figures are — and what they are not: they are the researcher's estimates based on token consumption, not confirmed billing. They also do not cover other costs the attacker may have had. But even as estimates, they point to an economic threshold researchers have long highlighted: automation can make intrusions against mid-sized targets profitable on an entirely new scale.

How the campaign was exposed

A technical mistake by the attacker enabled the discovery. Cairn is a framework for running AI agents, and the agent panels found exposed on the web revealed information about targets, discovered vulnerabilities, and credentials or keys captured during testing activity, according to a summary of The Hacker News and Tom's Hardware coverage.

NorForge found several apparently malicious panels but did not test whether the panels themselves could be controlled without a login — an open question that could have had significant implications for both detection and countermeasures.

The victims: what we know and what we don't

Fagerland himself did not name the victims. In its report, Cybersecurity News described the victims mainly as online stores in the United States, Canada, Australia and Japan. Reuters, however, was able to confirm specific targets by "independently reviewing the hacker's Cairn activity," identifying among others Deere (agricultural equipment), SharkNinja (home appliances) and Cummins (engines).

The companies' responses varied. Deere told Reuters it had carried out "the necessary remediation measures," adding that there was "no indication that sensitive information was accessed." SharkNinja said the breach affected a standalone website containing only product support information, and that the threat had been remediated. Cummins said only that the company was investigating the reports. Two smaller confirmed victims did not respond to Reuters inquiries.

An important caveat applies to the entire victim picture: it has not been confirmed that sensitive data was actually stolen from any of the victims. No data exfiltration is documented in available reporting — the goal of access to payment systems was, according to the researcher, aimed at future exploitation, not documented theft.

Who the attacker is — and which models were used

The attacker appears to be Chinese-speaking, based on the language of the instructions. That is all that is documented: nationality, affiliations, and whether this is a single person or a group are unknown.

The question of which models were used is equally uncertain. The agent execution environment confirmed by NorForge was named "claudecode_deepseek-v4.1-flash" — suggesting a configuration built on Claude Code and DeepSeek. But the name alone does not confirm the internal configuration, and Fagerland himself said, according to the reporting, that it is very difficult to determine which models were actually used.

The experts: why this is happening now

Both the scale and the economics of this campaign are tied to a broader trend. Jessica Ji, senior research analyst at Georgetown University's Center for Security and Emerging Technology (CSET), tells Fortune that the rise in autonomous AI attacks is primarily due to the tools having "become meaningfully better" in recent years. AI companies have in particular improved the models' coding abilities, which has led to a "dramatic increase in their ability to perform cybersecurity-relevant tasks, such as analyzing large amounts of code."

It is this connection that makes the case significant beyond the specific victims: not a new vulnerability type, but a new production method for intrusions, in which a short verbal instruction replaces manual reconnaissance, exploit development and maintenance.

What remains unresolved

Several key questions remain open:

• Data exfiltration: No established theft of sensitive data from Deere, SharkNinja, Cummins or any other victim is documented.
• The attacker's identity: Apart from the language of the instructions, we know nothing about who is behind this.
• The model configuration: The environment name suggests Claude Code and DeepSeek, but this is not confirmed.
• The source of the figures: Key numbers such as 1,200 targets, 100 intrusions, 23 hours and $50 rest on secondary accounts of NorForge's research, not on the primary report itself.

What remains nonetheless is a documented first look at how autonomous AI attacks are actually carried out in practice — the mechanics, the pace, the economics and the limitations. For defenders, that may be the most important lesson: the agents were effective, but not invisible. They were methodical, slow, and left behind exposed control panels that ultimately exposed the entire operation.