AI-driven hacking campaign breaches more than 100 company websites

Traders Union
All News
Business & Wealth
Companies
AI-driven hacking breaches 100 sites

Highlights

A Chinese-speaking hacker used Cairn AI agents to autonomously probe over 1,200 e-commerce sites across the U.S., Canada, Australia, and Japan since September 25.
Successful breaches typically require about 23 hours and $50 in AI agent token costs per site, compromising over 100 companies, according to NorForge's Snorre Fagerland.
Corporate responses vary as Deere, SharkNinja, and Cummins report investigations or containment, while global incidents highlight rising cyberattacks using agentic AI and theft of at least 600,000 credit card records.

Research findings on the AI-led intrusion campaign

As reported by Reuters, cybersecurity researcher Snorre Fagerland of NorForge says he observes a Chinese-speaking hacker outsourcing most of a hacking spree to AI agents that autonomously probe and compromise websites. In a report provided ahead of publication on Monday, he says the activity is among roughly two dozen malicious uses he identifies after finding exposed instances of Cairn, an open-source AI problem-solving platform used by hackers.

Fagerland says the most prolific hacker begins on September 25 by directing AI agents at e-commerce websites in the U.S., Canada, Australia and Japan. By late last week, the agents have attempted to break into more than 1,200 sites, while successful intrusions typically take about 23 hours and consume roughly $5,000 in tokens in total, or about $50 per successful hack.

He says the hacker’s instructions are brief, often fewer than 100 Chinese characters, but the agents still carry out sophisticated steps with little or no supervision. In one case, after failing to breach a company’s public-facing application, the AI agents search digital records for related infrastructure, find a public-facing control panel, identify a subtle data-processing weakness and ultimately use it to execute malicious commands on the server.

Corporate response and wider cybersecurity impact

Reuters independently reviews the hacker’s Cairn activity to identify victims not named in Fagerland’s report. Deere says it takes necessary remediation actions and has no indication sensitive information is accessed, while SharkNinja says the incident affects a standalone product-support site and the threat is contained; Cummins says it is investigating a potential cyber-attack involving a website operated by a third-party vendor.

Reuters is not able to determine to what extent the breaches lead to unauthorized data extraction. Fagerland says another hacker he observes steals a trove of credit card data, while a separate actor attempts to use AI agents to rob a cryptocurrency exchange.

The findings add to growing concern over agentic AI in cybersecurity. Recent incidents in South Korea and Japan are attributed to AI-using cybercriminals, while Israeli firm Gambit Security says in August and September that Russian-speaking extortionists and other actors use AI tools in campaigns that breach multiple organizations and steal at least 600,000 credit card records; cyber intelligence company Bitsight also says last week that discussion of autonomous agents is surging on cybercriminal forums.

Cohere’s planned acquisition of AI cybersecurity startup AISLE marked a push to strengthen AI-driven vulnerability detection as part of its broader build-out with Aleph Alpha and its European expansion. Our earlier article noted that AISLE’s technology had already identified hundreds of new software bugs, including multiple OpenSSL vulnerabilities, underscoring how AI is increasingly being positioned as a defensive tool to find and fix security weaknesses faster.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.