Exclusive: How one hacker used an AI agent and a few thousand dollars to breach dozens of websites

Snorre Fagerland, a threat researcher at cybersecurity company NorForge, found that a Chinese-speaking hacker used an AI agent to launch automated intrusion attempts against more than 1,200 websites, breaching the sites of more than 100 companies, including Deere, SharkNinja and Cummins. In a report submitted to Reuters, Fagerland said he discovered the hacker while scanning exposed instances of the open-source AI problem-solving platform Cairn, and that since about October 2 he had found about two dozen Cairn instances being used for malicious activity. The hacker targeted e-commerce sites in the United States, Canada, Australia and Japan starting September 25, with instructions of fewer than 100 Chinese characters, and successful intrusions typically took about 23 hours. Fagerland estimates the campaign used a mix of DeepSeek and Anthropic's Claude Code, consumed about $5,000 in tokens, and averaged about $50 per successful intrusion.