One Hacker, AI Agents and About $5,000: What Reuters Found in a 100-Site Breach Campaign

A Reuters exclusive published on October 19, 2026 describes a single Chinese-speaking hacker who used AI agents to break into the websites of more than 100 companies, doing little of the work by hand. Reuters reporter Raphael Satter, citing researcher Snorre Fagerland of NorForge, reports the campaign began on September 25, targeted e-commerce sites in the United States, Canada, Australia and Japan, and had attempted more than 1,200 sites by late the previous week. The estimated cost was about $5,000 in AI tokens, or roughly $50 per successful hack, per Reuters via Yahoo.

What was reported

Reuters identified victims by reviewing the hacker's activity inside Cairn, an open-source AI problem-solving platform that Fagerland says is popular with hackers. Fagerland found about two dozen malicious Cairn instances from around October 2 by scanning for accidentally exposed ones. His report did not name the victims; Reuters did, from the data.

• Named victims: Deere, SharkNinja and Cummins, plus two smaller businesses that acknowledged being compromised.
• Models: the campaign appeared to use a mix of DeepSeek and Anthropic's Claude Code.
• Instructions: terse, under 100 Chinese characters.
• Company responses: Deere said it took "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone product-support site and was contained. Cummins said it was investigating a potential attack on a website run by a third-party vendor.
• Unknowns: Reuters could not determine how much data was extracted. Attribution to a Chinese speaker rests on the language of the instructions, which is a weak signal on its own.

The Cairn author, who goes by "le1xia0," did not answer questions; in a post on X they said the platform was not designed for hacking and that harmful use was not their intent.

A second, earlier campaign with the same tooling

Cairn also appeared in a September campaign uncovered by Gambit Security and reported by Forbes on September 22. Forbes Australia's version of the story reports:

• At least 30 websites accessed between September 10 and 15, with as many as 100 organizations targeted.
• Total cost of about $8,000, or $3 to $180 per target.
• A server holding details of at least 618,000 credit cards.
• A mix of DeepSeek, Kimi and an older Claude version (Claude Opus 4.6), tied together by open-source orchestrators named Cairn and Hermes. When the operator tried newer Claude versions, they were blocked.
• Anthropic said it identified and banned the account, and Cloudflare, which hosted the servers, had been shutting down the infrastructure.

Reuters notes Gambit separately described that campaign as involving 25 companies, so victim counts differ by source. Nothing in the reporting reviewed establishes that the September and October campaigns were run by the same person; the shared element is the tooling.

The economics, in numbers

The reported costs make the shape of the change clearer than the headline does.

Bars are drawn to a common dollar scale, so the per-target figures look small next to the campaign totals. Sources: Reuters (October) and Forbes (September).

Two pieces of our own arithmetic add context, and both depend on reported figures that have not been independently audited:

• $5,000 spread across more than 1,200 attempted sites is about $4 per attempt. A successful hack at $50 therefore implies a success rate in the low single digits of attempts, which is consistent with an automated scan-and-try approach that keeps costs low by failing cheaply.
• $5,000 at roughly $50 per success implies about 100 successes, which matches the "more than 100 companies" figure.

The comparison that matters for defenders is cost against time. A typical successful intrusion took about 23 hours, with a person writing sub-100-character instructions rather than exploit code. That moves the constraint from skilled labour to token budget and target discovery.

What the model mix reveals

Two details stand out for people who follow AI safety and security policy.

• Safeguards are model-specific. In the September case, newer Claude versions blocked the operator, who fell back to an older Claude and to DeepSeek and Kimi. A mixed fleet lets an attacker route around any single provider's refusals, which is why per-provider account bans are necessary but incomplete.
• Open tooling is part of the surface. Cairn is open source, and the researcher found the activity by scanning for exposed instances. The same openness that makes agent frameworks useful to developers also makes misconfigured deployments discoverable.

This sits alongside other recent security coverage on this blog, including Pwn2Own Ireland's results against AI coding agents, and it arrives the same day the US government moved to restrict DeepSeek in federal systems.

What defenders can take from it

Nothing in the reporting describes a novel vulnerability class. The reported entry points were ordinary websites, including a standalone support site and a third-party-run site. That makes the controls familiar ones, applied against a faster attacker:

• Inventory the edge: product-support, marketing and vendor-run sites are the ones Deere, SharkNinja and Cummins described. Know which exist and who runs them.
• Patch cadence over perfection: a 23-hour intrusion window compresses the time between disclosure and exploitation that patch policies assume.
• Checkout and payment pages: the September campaign reportedly installed skimmers on checkout pages, so script integrity monitoring on payment flows is directly relevant.
• Scan your own exposure: the researcher found these instances because they were exposed to the internet. Teams running agent frameworks should check that dashboards are not publicly reachable.
• Log for automation: high-volume, low-sophistication probing is easier to detect in aggregate than as individual events.

For teams building with agents, a model-agnostic workspace such as Metir keeps credentials, tool permissions and model choice in separate layers, which is the same separation these reports suggest attackers exploit from the other side.

What remains unknown

• Whether data was actually taken in the October campaign. Reuters could not determine this.
• Whether the two campaigns share an operator.
• How much of each model's contribution was reconnaissance versus exploitation, since the reporting describes the mix but not the split.
• Whether other providers have taken action beyond the Anthropic account ban reported in September. DeepSeek and Moonshot had not responded to Forbes' requests for comment at publication.

Sources:

• Exclusive: How one hacker used AI agents and a few thousand dollars to break into scores of sites (Reuters, Raphael Satter, Oct 19, 2026, via Yahoo)
• A Chinese Hacker Used AI To Attack 100+ Companies In One Of Largest AI Hacks Yet (Forbes, Thomas Brewster, Sep 22, 2026)
• A Chinese hacker used AI to attack more than 100 companies (Forbes Australia)

Image credits

Header and in-body image: Deere and Company Headquarters, Moline, Illinois, 1956-64, exterior, by Balthazar Korab, Balthazar Korab Archive, Library of Congress, no known restrictions on publication (public domain), via the Library of Congress. Illustrative; a historical photo.