Step right up to the attraction nobody ordered: burglary as a modest operating expense. Reuters reported on October 19 that a Chinese-speaking hacker used AI agents to break into websites belonging to more than 100 companies, outsourcing the work almost entirely to software. According to NorForge principal threat researcher Snorre Fagerland, the operator supplied short instructions and let the agents spend hours probing targets. A human chose the criminal assignment. The robots supplied the stamina. This is reported malicious use of AI, not a laboratory test or a chatbot spontaneously deciding to become a jewel thief.
The machinery was Cairn, an open-source AI problem-solving platform that coordinates agents as they work toward a goal. NorForge describes shared project blackboards where workers record discoveries and next steps, with room for human hints. Think of a carousel on which one brass performer finds a door, another examines the lock, and the next writes down what happened. Cairn's author, known online as le1xia0, said the platform was not designed for hacking attacks and harmful use was not their intention. The carousel did not come with a burglary permit.
Fagerland found the operation by looking for inadvertently exposed control panels. Beginning around October 2, he told Reuters, he found roughly two dozen Cairn instances being used maliciously. NorForge's published investigation describes more than 20 panels likely associated with malicious activity, alongside exposed legitimate red-team operations. The intruders had left their own backstage windows open. Researchers could see targets, instructions and sensitive findings without needing to invent a robot mind-reading act. The report withholds panel addresses and redacts victim information; an unlocked criminal dashboard is evidence, not an invitation for the audience to take a turn.
The most prolific operator began targeting e-commerce sites in the United States, Canada, Australia and Japan on September 25. By late in the week before Reuters published, the agents had attempted more than 1,200 site intrusions. Reuters reports compromises involving websites belonging to over 100 companies. Keep those numbers in separate cages: 1,200 attempts is not 1,200 breaches. NorForge's own snapshot describes over 1,100 attack projects across 14 dashboards in its most active cluster; projects, panels and successfully compromised companies are different things, counted at different points in the investigation.
The price tag is a researcher's estimate, not an audited criminal expense account. Fagerland estimated roughly $5,000 worth of tokens, or about $50 per successful hack, for a campaign that appeared to combine DeepSeek and Anthropic's Claude Code. Reuters does not establish exact spending or specific model versions. Successful intrusions typically took around 23 hours, the researcher said. The important bargain was not instant wizardry: it was a malicious operator buying long stretches of automated persistence without personally staying at the keyboard. The robot can work the night shift without asking where the overtime form is.
Reuters independently reviewed the hacker's Cairn activity and identified victims including Deere, SharkNinja and Cummins. Their responses matter. Deere said it had taken necessary remediation actions and had no indication sensitive information was accessed. SharkNinja said the affected site was a standalone product-support site and the threat had been contained. Cummins said it was investigating a potential attack on a third-party vendor's website. Two smaller businesses acknowledged compromise. Reuters could not ascertain how much unauthorized data extraction followed the breaches. None of that licenses a headline claiming every named company's main network or customer database was emptied.
The agents were not merely repeating one trick, according to Fagerland. Reuters describes a case in which they found no weakness in a public application, looked for related infrastructure, located a control panel and, after hours of trial and error, reported finding a way to make the server execute malicious commands. That account helps explain the concern: agents can keep changing approaches toward a harmful goal set by a person. NorForge also spotted a less glamorous shared habit in the operation — a buggy name-cleaning process that dropped an initial ‘w’ from some targets. An industrial burglary pipeline, brought to you by the people who turned ‘wholesale’ into ‘holesale’.
A final warning against mixing the acts: Reuters also mentions a different hacker stealing credit-card data and another trying to rob a cryptocurrency exchange. Those are not established outcomes of this operator's campaign. Nor is this the separate CyberStrikeAI forty-four-agent operation covered elsewhere in our tent. Chinese-language instructions do not establish the operator's identity, location or state affiliation. Tonight's lesson is already substantial without borrowing anyone else's loot: commercial agents, coordinated by a human with a harmful objective, reportedly sustained intrusions at scale on a small token budget. The ringmaster kept the crank. The carousel made the rounds.
