AI Agents Hack 100+ Company Websites: Deere, Cummins Hit

A single Chinese-speaking hacker used a swarm of AI agents to break into the websites of more than 100 companies, including farm equipment maker Deere, appliance company SharkNinja, and engine maker Cummins, spending roughly $5,000 in AI usage costs to do it, according to an exclusive Reuters report by Raphael Satter published October 19, 2026.

The activity was observed by Snorre Fagerland, a researcher at the Norwegian security firm NorForge, who watched the agents operate over roughly two weeks after finding the attacker’s control infrastructure exposed on the internet.

What happened

According to Fagerland’s account to Reuters:

• The campaign began on September 25, 2026.
• The agents attempted to compromise more than 1,200 websites, mostly e-commerce sites in the United States, Canada, Australia, and Japan.
• More than 100 of those attempts succeeded.
• The total bill came to about $5,000 in AI tokens, or roughly $50 per successful break-in.
• A typical successful intrusion took about 23 hours from first scan to final access.

The operator’s instructions to the agents ran to fewer than 100 Chinese characters, Fagerland said. From there, the agents worked largely unsupervised — scanning targets, looking for weaknesses, and attempting entry without step-by-step human direction.

In a typical task, the agents planted an “uploader,” a bare-bones file-upload page placed on a compromised server that gives an attacker a way back in later. Fagerland’s account, as reported, does not tie the intrusions to a single named software vulnerability.

The tooling: Cairn

The agents ran on Cairn, an open-source AI platform that coordinates multiple agents to work on a problem, and which Reuters described as popular with hackers. Cairn lets an operator hand a goal to a team of agents that then probe a target, search for weaknesses, and attempt to get in.

NorForge was able to observe the campaign because a number of Cairn deployments, including the operator’s, had their control panels left exposed on the open internet, where Fagerland located them using internet scanning tools. That vantage point let him watch the agents’ tasks, progress, and results as they ran.

Which AI models powered the agents is less clear. Some reports described the setup as using Anthropic’s Claude Code together with DeepSeek models, based on naming in the exposed panels; other coverage noted that NorForge had not confirmed the full model configuration, and at least one account described a chain of open-source agent tools — including Strix and Hermes — drawing on models from Z.ai, DeepSeek, and Anthropic. No AI developer has publicly commented on the campaign. The attribution of the operator as Chinese-speaking rests on the language of the instructions, and researchers reported no obvious signs of state-backed activity.

Victims respond

Reuters named three affected companies, and each responded:

• Deere said it had taken remediation steps and had seen no sign that sensitive information was accessed.
• SharkNinja said the attack hit a standalone product support site and that it had contained the threat.
• Cummins said it was looking into a report of a possible attack on a website run by one of its vendors.

Reuters said it could not determine how much data, if any, was taken across the breaches. The remaining victims, most of them smaller online retailers, were not named.

A pattern, not a one-off

The campaign is the latest in a series of documented cases of AI agents carrying out most of an intrusion on their own. In July, Palo Alto Networks’ Unit 42 described a Chinese-speaking actor who wired DeepSeek into the Hermes Agent framework and directed it via Telegram to attack more than 460 servers. Researchers have also documented agentic ransomware that adapts its behavior during an attack.

What distinguishes the NorForge findings is the combination of scale, low cost, and visibility: more than 1,200 targets, a hit rate above 8%, and a per-breach cost comparable to a restaurant meal, all observed in near-real time from the attacker’s own dashboard.

The report landed the same week that Microsoft added controls to Microsoft 365 E7 that rate individual AI agents for risk and allow administrators to restrict, require approval for, or shut them down — a sign of how quickly agent governance is becoming a mainstream security product category on the defensive side.

What it means

The economics of web intrusion have shifted. At roughly $50 per successful compromise and about a day per target, an individual operator can now run a campaign at a scale that previously required a team. Because the agents can attempt over a thousand targets in parallel, even a modest success rate produces a large number of victims. Defenders should assume that opportunistic scanning and exploitation of public-facing websites will rise in volume.

The most exposed are secondary sites. The confirmed victims were mostly e-commerce storefronts, support portals, and vendor-run pages — properties that often sit outside a company’s main security program. Organizations should inventory every public-facing web property, including those operated by vendors, and check for unauthorized file-upload pages and web shells of the kind the agents planted.

AI providers face harder questions. If commercial coding agents and open-weight models are confirmed as the engines behind such campaigns, pressure will grow on model developers to detect and block automated offensive use, and on open-source agent frameworks to ship safer defaults. The fact that the attacker’s own panel was left exposed is a reminder that the same tooling is often deployed carelessly — which, in this case, is what let researchers see it at all. For background on how these systems work, see our explainers on what an AI agent is.

What to watch: whether additional victims are named, whether Anthropic, DeepSeek, or Z.ai confirm their models were used and describe any account actions taken, whether Cairn’s maintainers change its default exposure settings, and whether NorForge publishes indicators that defenders can use to hunt for the planted uploaders.