One hacker used AI agents to break into 100+ companies for $5,000

A cybersecurity researcher spent two weeks watching a single operator turn AI agents loose on the web, and the receipts are unusually complete — because the attacker left the control panels open.

A Chinese-speaking hacker used AI agents to attempt more than 1,200 break-ins and successfully compromise websites belonging to over 100 companies, including farm equipment maker Deere, appliance maker SharkNinja and engine maker Cummins, for roughly $5,000 worth of tokens — about $50 per successful hack, according to Reuters. The attacker did almost none of the work: AI agents spent hours autonomously probing targets, and the successful ones ran about 23 hours from first contact to working access. The campaign started on September 25 against e-commerce sites in the United States, Canada, Australia and Japan, and was still running late last week.

The investigation that exposed it came from NorForge principal threat researcher Snorre Fagerland, who was looking for something else. Fagerland was scanning the open web for exposed instances of Cairn, an open-source AI problem-solving engine that has become popular with criminals, and found more than twenty panels running malicious work, per NorForge's report. Because the operators left those dashboards unauthenticated, he could read the tasking in full: fewer than 100 Chinese characters of instruction per campaign, targets pre-filtered by traffic (200,000 to 1.5 million monthly visits) and pre-tested with the browser automation framework Playwright to confirm orders could be placed, and an explicit goal of an uploader webshell for later monetisation rather than a command shell.

What the agents did with those short instructions is the part defenders should read closely. In one documented case the agents found no weakness in a large company's public-facing application, so they went looking sideways: they combed digital records for associated infrastructure, found a public-facing control panel, identified a subtle flaw in how it processed data, and after hours of trial and error tricked the server into executing commands. "It's not straightforward to come up with solutions like that," Fagerland told Reuters. "It's not script kiddie stuff." NorForge's own summary of the cluster is blunter — the attackers left their own panels wide open, and the same carelessness that gave researchers a window also published their targets' credentials to the internet.

NorForge's numbers put the cost on the table. Across the clusters it observed the average success rate sat near 10 percent, with most failures still producing reconnaissance that fed later attempts, and projects generating about 140 recorded findings each. On the tooling side, one cluster's agents ran under a worker named claudecode_deepseek-v4.1-flash — a Claude Code harness driving DeepSeek's 4.1 Flash model — and NorForge estimates the average task cost around five dollars, with the longest projects, some past 1,000 recorded steps, running above $100. Reuters' figure for the campaign as a whole lands in the same range: about $5,000 of tokens for 1,200 attempts and 100-plus compromises.

The victims are real companies, and their responses are the usual ones. Reuters reports Deere said it took "necessary remediation actions" and had "no indication that sensitive information was accessed"; SharkNinja said the intrusion hit a standalone product-support site and was contained; Cummins said it was investigating an attack on a site operated by one of its third-party vendors. Two smaller businesses also acknowledged being compromised, and Reuters could not establish how much data, if any, was extracted.

That cost structure is the actual news. Five thousand dollars used to buy a weekend of a skilled operator's attention or a handful of targeted phishing kits; here it bought 1,200 autonomous intrusion attempts and at least 100 working compromises, with the agents handling reconnaissance, exploit chaining and retries without supervision. The capability is not unprecedented — a 10 percent hit rate against lightly defended web applications is roughly what a determined human attacker achieves — but the throughput per dollar is, and that shifts the defensive question from "who is attacking us" to "how many attempts are running against us right now".

Nor is it isolated. Reuters notes the Israeli firm Gambit Security documented an agent-driven spree in September that breached 25 companies and stole at least 600,000 credit card records, after Russian-speaking extortionists used SpaceX's Cursor tool to hit seven organisations in August, while the cyber intelligence firm Bitsight says discussion of autonomous agent workflows is surging across criminal forums. We covered a parallel case earlier this month — India says AI agents broke into live systems — undetected — and the shape is the same each time: the agents work, the defenders often do not know, and the tooling is commodity. What is new in Fagerland's find is the paper trail, and the awkward fact that the campaign was visible only because the criminals failed at basic operational security.

AI-agent shopping is growing fast on Stripe — and Stripe still won't say how big. Purchases made by AI agents through Stripe's Link wallet grew 38-fold in September while payment volume rose 20-fold, reported by The Decoder, citing Upstarts Media. Stripe disclosed no absolute numbers, and the growth started from a small base. Stripe executive Dan Hill says the volume is now becoming significant and that the number of agents using Link has grown from about 70 at the time of the analysis to roughly 200, including Meta's Muse and Grok Bot; most agent transactions run around $100, though some users have them booking flights and buying furniture worth thousands. Retail made up 36 percent of transactions and 32 percent of volume, with travel next at 28 percent. Link hands agents a separate 16-digit card number instead of the user's real credentials, with spending limits the customer sets — and Hill concedes PayPal and Shopify's Shop Pay will compete for the same traffic. We covered the shared plumbing behind this in October — Meta, Walmart and Stripe publish the Personal Agent Protocol.

Google's 780-megawatt Minnesota data centre is becoming the test case for who pays for AI's power. The deal with Xcel Energy would add 1,400 megawatts of wind, 200 megawatts of solar and 300 megawatts of battery storage — more capacity than the site will draw — and Google would pay for at least 75 percent of its contracted capacity even when it uses less, plus up to eight years of minimum demand charges if it exits early, per CNBC. Xcel says the new power serves all local customers, not just Google. The Minnesota Public Utilities Commission has not approved the agreement, and the state's attorney general has asked it to withhold approval, arguing Xcel has not shown the deal shields other customers from stranded costs. Public opinion is hostile: a Gallup survey in March found 71 percent of Americans opposed a data centre in their local area, and Pew found half expected data centres to be mostly bad for household energy bills. Two experts told CNBC much of the buildout could be avoided by siting smaller facilities where the grid already has spare capacity — though utilities earn returns on new construction, which is an incentive of its own.

What to watch: whether the exposed Cairn panels and the harness behind them get shut down, whether agent-platform vendors start shipping abuse detection as a feature, and whether Minnesota approves the Xcel template — that decision will be cited in every other hyperscaler's power case.

If $5,000 now buys 100 successful intrusions, should AI platforms be liable for what their users automate? Write to us via our contact page.