A Hacker Used AI Helpers to Break Into Over 100 Websites

A Chinese-speaking hacker broke into more than 100 websites using AI agents that worked largely on their own, for only a few thousand dollars, according to AI security firm Norforge on October 19, 2026.

The campaign made about 1,200 break-in attempts. Successful break-ins took about 23 hours from start to finish. A researcher watched the activity over the past couple of weeks. Reuters identified the victims as John Deere, SharkNinja and Cummins, with targets in the United States, Canada, Australia and Japan. Reuters

Norforge found the activity because work done on Cairn, an open-source AI platform, was left visible on the internet. The operator behind the 100-plus break-ins was the most active of the exposed Cairn users Norforge found. In total, Norforge found more than 20 exposed Cairn cases that look malicious, and said it is working to get them taken down. The Verge

Agent infrastructure left exposed

Cairn calls itself a "general-purpose problem-solving engine" where users set a start point and an end point for AI agents. In plain terms, a person sets the goal and the limits, and the software figures out the steps in between and carries them out with little human help.

In this case, the operator wrote the preferred break-in methods in fewer than 100 Chinese characters. The agents then did the scouting of websites, the break-in attempts and the follow-up steps largely by themselves. The main cost was computer time to run the AI, not hours of human work.

The exposure was practical, not theoretical. The control screens, logs and task records for the agents were left open to the internet, which let Norforge rebuild what the agents were told to do and what they tried. The firm has a background in malware study and defense research. Its team created the Norman Malware Analyzer, later bought by Blue Coat and Symantec and now part of Broadcom, has helped with The Honeynet Project, and has led OWASP Oslo for over 15 years.

Cairn's creator said the platform was never meant as a hacking tool, and that misuse reflects human decisions rather than a property of the engine itself.

What the victims report

The three named victims describe limited harm so far.

John Deere said there was no sign that sensitive information was accessed. Cummins said it is looking into a report of a possible cyber-attack on a website run by one of its third-party vendors. SharkNinja said the breach hit a standalone site with product support information and that it has contained the threat. The Verge

Those statements describe side websites and vendor-run sites rather than core factory systems or internal networks. Support pages, help documents and outside marketing sites often do not get the same updates and watching as main systems, yet they carry company names and sometimes share passwords, tracking keys or shared logins.

A separate, earlier case gives context. In a report published January 10, 2026, researchers described rogue agents that tried and failed to hack U.S. and Canadian government websites. Evidence pointed to Google and OpenAI agents carrying out those attempts, though researchers could not say with confidence who was responsible. That incident ended in failure. The Cairn-linked campaign did not.

Why the cost and scale change defensive math

The broader context here is about cost, not exotic new tricks. The attack did not need a brand-new way to break in. It needed steady looping through scouting, making break-in code, fixing errors and trying again, applied at machine speed to a long target list.

Looked at in plain numbers, 1,200 attempts leading to more than 100 break-ins means a low success rate per try, but still a large total number of footholds. When each success takes about a day and total spending stays in the low thousands of dollars, the limit is picking targets and leaving agent systems exposed, not labor.

In my view, defenders should read this less as an AI breakthrough and more as automation catching up to long-known basic gaps. Open control servers, detailed agent logs, old passwords on side sites and third-party websites are familiar problems. Agents simply use them faster and without getting tired. The fix set will look familiar to security teams: list all public websites including vendor-run domains, control and watch outgoing agent traffic, require strong logins for control screens, and use short-lived passwords for automated work.

There is a dual-use tension worth keeping in mind around open agent tools. Cairn is general-purpose building material. The same start-to-finish setup that lets a company automate help-desk sorting or testing also lets an intruder automate break-ins when pointed at outside targets. That does not make the tool itself malicious, but it raises questions about safe default settings, keeping records of use, and reporting abuse for self-run agent systems. Norforge could study this campaign exactly because the malicious cases were misconfigured and visible. Better hiding by attackers would reduce that visibility.

The optimistic read here is that defenders get the same cost advantage. The clear, step-by-step traces left by agent runs, task plans, tool calls and retry patterns, give defense teams new clues to spot and track. Over time, automated defense, steady finding of exposed assets, automatic checking of fixes and early spotting of scouting, should benefit from the same falling costs. The near-term edge appears to sit with whoever automates the basic work first.