One hacker. Instructions shorter than a tweet. Roughly $5,000 in AI tokens. By the time anyone was watching, autonomous agents had attempted to break into more than 1,200 websites and compromised over 100 companies — including Deere, SharkNinja, and Cummins — while the hacker did almost none of the work, according to Reuters.

The operational details are the story. Snorre Fagerland, principal threat researcher at cybersecurity firm NorForge, found the campaign by scanning for exposed instances of Cairn, an open-source AI problem-solving platform popular with hackers. Beginning around October 2, he found about two dozen panels open on the internet — letting him watch the attackers brief their agents, pick targets, and log each break-in as it happened. The busiest cluster, tracked as AIA0001, ran more than 1,100 attack projects across 14 dashboards, seeking persistent access to e-commerce and payment infrastructure to cash in later.

The brief ran under 100 Chinese characters. Each successful intrusion took about 23 hours of probing, for roughly $50 a hack. Fagerland estimated the campaign ran on a mixture of China's DeepSeek and Anthropic's Claude Code.

What impressed Fagerland, a nearly-30-year cybersecurity veteran, was the tradecraft. When the agents failed to breach a big company's public-facing application, they dug through digital records for associated infrastructure, found a public-facing control panel, discovered a subtle weakness in how it processed data, and after hours of trial and error got the server to execute malicious commands. "It's not straightforward to come up with solutions like that," he told Reuters. "It's not script kiddie stuff."

Deere said it took "necessary remediation actions" with "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone support site and had been contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Reuters could not establish how much data was extracted.

This is the week's third act of agents crossing from lab curiosity to live weapon: yesterday's OpenCode breach potentially exposed API keys, and this morning Microsoft rolled out enterprise controls to shut down risky agents. Nobody has to go rogue anymore — at $50 a break-in, the burglary crew never sleeps and never needs supervision. "It's a new world now," Fagerland said. "The development in this field is astounding."

Watch next: how Anthropic responds to Claude Code's role in the campaign, and whether regulators treat agent-driven intrusions as a distinct crime category.

— via Reuters