AI Hacker Breached 100+ Firms for Just $50 [2026]

A hacker working with little more than open-source AI tools and a few thousand dollars of cloud spending broke into the websites of more than 100 companies this fall, according to a Reuters investigation published October 19, 2026. The campaign, which attempted to compromise over 1,200 sites across the United States, Canada, Australia and Japan, used an open-source AI orchestration platform called Cairn paired with DeepSeek and Anthropic’s Claude Code to automate most of the work that would once have required a skilled human penetration tester.

The disclosure, first reported by Reuters and corroborated by The Verge, names agricultural equipment maker Deere, appliance brand SharkNinja and engine manufacturer Cummins among the confirmed victims. It is one of the clearest public examples yet of an AI agent hacking attack carried out at industrial scale by what appears to be a single operator rather than a nation-state team or a organized criminal group with dozens of staff.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What Happened: Inside the AI Agent Hacking Attack

Snorre Fagerland, principal threat researcher at NorForge, is the person credited with spotting the campaign. According to Reuters, Fagerland traced a wave of suspicious website probing back to a Chinese-speaking operator who had assembled an automated hacking pipeline around Cairn, an open-source AI problem-solving platform that is not itself designed for offensive security work but can be pointed at almost any technical task, including finding and exploiting web application flaws.

The operator fed the system fewer than 100 Chinese characters of instructions per target, according to the reporting cited by Ground News. From there, the AI agents handled reconnaissance, vulnerability discovery, exploit testing and, in successful cases, actual intrusion into the target’s web infrastructure, largely without further human intervention. That is a meaningfully different workflow than the AI-assisted cyberattacks security teams have debated for the past two years, where human operators still drove most of the decision-making and used AI mainly to speed up phishing content or code snippets.

Reuters reports the campaign began on September 25, 2026, and ran for several weeks before Fagerland’s findings became public. During that window, the operator is said to have attempted intrusions against more than 1,200 websites, succeeding against over 100 of them. If those figures hold up, the success rate sits above 8 percent, which is notably high for an unattended, low-cost automated campaign, though neither Reuters nor NorForge has published a precise breakdown of how many of the 1,200 attempts were fully automated versus partially hand-guided.

Which Companies Were Hit

The three companies named in the Reuters report, Deere, SharkNinja and Cummins, span farm equipment, home appliances and heavy engine manufacturing. None of the three is primarily a software company, which fits a pattern security researchers have flagged for years: industrial and consumer-hardware firms often run older or less-hardened web infrastructure around their marketing sites, support portals and dealer networks, even when their core product engineering is sophisticated.

Reuters has not disclosed the identities of the remaining victims among the “more than 100” confirmed breaches, and it remains unconfirmed exactly what data or systems were accessed at each company, or whether the intrusions reached beyond public-facing websites into internal networks. CTV News, which also covered the Reuters exclusive, likewise stopped short of detailing the scope of data exposure at individual firms, suggesting that part of the investigation is still ongoing.

The Economics of an AI-Driven Breach: $50 a Hit

What has drawn the most attention from security professionals is the cost structure. Reuters puts the operator’s total AI-token spending at roughly $5,000 across the entire campaign, which works out to about $50 for every successful breach once the unsuccessful attempts are factored in. A typical successful intrusion took around 23 hours of automated probing and testing, largely unattended, according to the same reporting.

That price point reframes what a meaningful AI agent hacking attack actually costs to run. A single contracted penetration test against one mid-sized company’s external attack surface routinely runs into five or six figures when billed by a reputable security firm, and it is bounded by how many hours a human tester can bill. The economics described in the Reuters piece invert that constraint: the bottleneck becomes compute and API spend rather than analyst hours, and both of those get cheaper every quarter as model providers compete on price.

Inkl’s write-up of the story, published under the headline “It’s Not Script Kiddie Stuff”, captures the tone of the reaction among researchers who reviewed the findings: this was not a crude mass scanner firing off known exploits, but a workflow that could reason through unfamiliar web applications, adapt when an initial approach failed, and keep working across hundreds of distinct targets without a human rewriting the attack logic each time.

Campaign by the Numbers

Metric	Reported figure
Campaign start date	September 25, 2026
Websites targeted	More than 1,200
Companies confirmed breached	More than 100
Regions targeted	United States, Canada, Australia, Japan
Human instruction length per target	Fewer than 100 Chinese characters
Typical time to successful intrusion	Around 23 hours
Total estimated AI token cost	Approximately $5,000
Estimated cost per successful breach	Approximately $50

Cairn, DeepSeek and Claude Code: The Tools Behind the Campaign

Cairn is the piece of this story likely to draw the most scrutiny going forward. Described in the Reuters report as an open-source AI problem-solving platform, it was not built as a hacking tool. Its design purpose is general technical problem-solving, the kind of agentic loop where an AI model is given a goal, a set of tools, and the ability to iterate on its own output until the goal is satisfied. That same loop, pointed at a company’s login forms, content management systems and API endpoints instead of a coding puzzle, turned into a functioning intrusion pipeline.

Inside that pipeline, Reuters reports the operator relied on two underlying models: DeepSeek and Anthropic’s Claude Code. The exact division of labor between the two has not been confirmed publicly, and it remains unclear whether one handled reconnaissance while the other handled exploit generation, or whether the operator switched between them depending on cost and task. What is clear is that both are widely available, commercially supported AI systems rather than underground or jailbroken models, which is part of why this case has unsettled researchers who track AI-enabled cyberattacks more broadly.

Anthropic has built Claude Code into one of the most capable coding agents on the market, a status reinforced by recent releases such as Claude Code 2.1.302, which shipped dozens of fixes as the company races rivals on automated code review. DeepSeek, meanwhile, has spent much of 2026 positioning itself as a low-cost, high-performance open alternative to Western frontier labs, most recently with the V4.1-Flash-1017 release that opened its search capabilities through a public API. Both companies’ tools were apparently used here for a purpose neither intended, which is a problem dual-use AI vendors have struggled to design around.

Tools Used in the Campaign

Tool	Type	Reported role in the campaign
Cairn	Open-source AI problem-solving platform	Orchestrated the automated attack workflow
DeepSeek	Commercial AI model	Used for reasoning and task execution within Cairn
Claude Code	Anthropic coding agent	Used for reasoning and task execution within Cairn

Who Is Behind It: An Unconfirmed Identity

Reuters describes the operator only as Chinese-speaking, based on the language used in the instructions fed into the Cairn platform. The outlet has not confirmed whether a single individual ran the entire campaign or whether a small group shared the infrastructure. No legal action, arrest or formal attribution to a specific person or organization has been reported as of October 19, 2026. Readers should treat any claim about the hacker’s identity, nationality beyond “Chinese-speaking,” or affiliation with a larger group as unverified until investigators or prosecutors say otherwise.

That ambiguity is itself part of the story. Startup Fortune’s coverage, headlined around the idea of a lone hacker breaching more than 100 companies, highlights how much use a single motivated person now has when AI agents can substitute for a team of specialists. Attribution in cybercrime has always been hard; it gets harder when the actual technical work was performed by general-purpose AI systems that leave a different forensic fingerprint than a hand-written exploit kit.

Why This Differs From Previous AI-Assisted Hacking Cases

Security researchers have warned about AI-assisted hacking since large language models became broadly capable writers of working code, roughly 2023 onward. Most documented cases until now involved AI as a force multiplier for a human-led operation: drafting more convincing phishing emails, generating malware variants, or speeding up the writing of exploit code that a person still had to test and deploy. The campaign described by Reuters moves further down the automation curve. The AI agents reportedly handled the iterative trial-and-error of vulnerability discovery across more than 1,200 distinct web applications, a task that previously required a human to understand each target’s specific stack and adapt tactics accordingly.

This lands in a year that has already produced several high-profile breaches and warnings tied to automation and connected infrastructure, including large-scale healthcare data exposure incidents and a steady drumbeat of zero-day disclosures such as the Ivanti Connect Secure chain that let attackers escalate to root access. None of those cases involved AI agents running the attack chain end to end the way this one reportedly did, which is why Fagerland’s findings are being treated as a bellwether rather than an isolated incident.

The Open-Source AI Debate Gets a New Data Point

Cairn’s role as an openly available platform reignites a debate that has run through the AI industry for the past two years: does open access to powerful agentic AI tools accelerate defense and research faster than it accelerates abuse, or is the balance reversed once a capable enough model is in general circulation? Anthropic executives have been vocal on one side of that argument. The company’s leadership has previously warned that open releases of frontier-class AI carry more risk than proprietary, access-controlled deployment, a position this campaign will likely be cited to support, even though Anthropic’s own Claude Code was reportedly used as one of the two models inside the attack pipeline.

That detail cuts both ways in the policy conversation. It shows that gatekeeping a model behind a commercial API and usage policy does not, by itself, prevent misuse once a determined operator has the money for API calls and the technical know-how to wire it into an open orchestration layer like Cairn. Both the “keep it open” and “keep it closed” camps are likely to point to different parts of this story as vindication.

How This Compares to Traditional Penetration Testing

It is worth being precise about what the $50-per-breach figure does and does not represent. It covers AI token spending only, not the time the operator spent setting up infrastructure, choosing targets, or handling whatever came after a successful intrusion, such as exfiltrating or selling data. It also reflects a campaign run against publicly reachable web infrastructure rather than hardened internal networks protected by segmentation, multi-factor authentication and endpoint detection.

Even with those caveats, the gap between $50 in AI spend and the tens of thousands of dollars companies pay for authorized penetration tests is large enough to change incentives. A legitimate security firm has to pay skilled analysts, carry liability insurance and deliver a polished report; an attacker running an AI agent hacking attack has none of those costs and does not need every attempt to succeed, only enough of them to.

Market Impact: Pressure on AI Vendors and Security Firms

The immediate market reaction has centered on two groups: AI model providers and the web application security industry. For AI vendors, this is another instance of a general-purpose coding or reasoning agent being repurposed for offensive security, which raises uncomfortable questions about usage monitoring, rate limiting and anomaly detection on API traffic that resembles automated reconnaissance. Anthropic, DeepSeek and the maintainers of Cairn have not publicly detailed what, if any, changes they plan to make to detect or block this kind of usage pattern.

For security vendors, the campaign is a strong selling point for products that claim to detect automated, AI-driven probing rather than relying purely on signatures built from known exploit kits. Web application firewall and bot-management companies have spent much of 2026 marketing “AI versus AI” defensive positioning, and this disclosure gives that pitch a concrete, named example to point to in sales conversations with the kind of mid-sized industrial and consumer brands that made up most of the victim list here.

Historical Context: How We Got Here

Warnings about AI lowering the barrier to cybercrime are not new, but they have mostly stayed theoretical or focused on narrow use cases like phishing text generation. This year alone has brought growing scrutiny of automation risk in physical and industrial systems, alongside a steady stream of conventional breaches affecting tens of millions of records at a time. What changes with the Reuters report is the scale and autonomy demonstrated by a single operator with a modest budget. Where earlier AI-cyberattack warnings described a future risk, this campaign is being treated as the first well-documented instance of that risk playing out against more than 100 real companies over several weeks, starting in late September and surfacing publicly in mid-October.

It also arrives alongside broader industry anxiety about how fast agentic AI tools, originally built for legitimate software development, are being adapted for other purposes. Coordination platforms for AI coding agents, such as the recently launched BAND platform, were designed to help developers manage multiple AI agents working on legitimate software projects. The same underlying pattern, multiple AI agents coordinated against many targets with minimal human oversight, is exactly what reportedly powered this hacking campaign.

What Companies Should Do Now

Audit public-facing web infrastructure, including marketing sites, dealer portals and support systems, which are often lower priority for patching than core production systems.
Assume automated, adaptive probing rather than static scanning when modeling threats to internet-facing applications.
Monitor for unusually persistent, low-and-slow reconnaissance patterns that can run for many hours without triggering traditional rate-limit alerts.
Review API access logs for AI coding and reasoning tools where they touch anything resembling production credentials or infrastructure configuration.
Treat website security with the same rigor as internal network security, since this campaign specifically targeted external sites rather than internal systems.

Predictions: Where AI-Driven Hacking Goes Next

Several trends seem likely to follow from this disclosure over the coming months, based on how the industry has responded to similar inflection points in the past.

Expect more open-source agentic platforms similar to Cairn to be scrutinized or forked specifically for security testing, both offensive and defensive.
AI vendors will face growing pressure to build abuse-detection systems tuned to reconnaissance-like usage patterns rather than just content filtering on individual prompts.
Bug bounty programs and managed security providers will likely start marketing “AI-speed” testing services that mirror the cost and speed of automated attacks, closing the economic gap described in the Reuters report.
Mid-sized industrial and consumer-hardware companies, the profile shared by Deere, SharkNinja and Cummins, will come under more scrutiny for how they secure peripheral web assets rather than just core products.
Regulators and standards bodies already focused on AI-enabled cyber risk will likely cite this case directly in future guidance, given how closely it matches scenarios they have warned about in the abstract.

What Remains Unconfirmed

Several important details have not been established in public reporting as of October 19, 2026. The hacker’s exact identity and whether one person or several people operated the campaign remain unknown. The precise division of labor between DeepSeek and Claude Code inside the Cairn pipeline has not been detailed. It is also not confirmed whether all of the “more than 100” breached companies suffered meaningful data exposure or simply had a vulnerability demonstrated against their web infrastructure. Readers and companies evaluating their own exposure should treat these as open questions rather than settled facts until NorForge, Reuters or the affected companies provide further detail.

Frequently Asked Questions

What AI tools did the hacker use?

According to Reuters, the operator used an open-source AI orchestration platform called Cairn, running on top of DeepSeek and Anthropic’s Claude Code to automate reconnaissance and exploitation.

How many companies were affected by this AI agent hacking attack?

Reuters reports more than 100 companies were successfully breached out of over 1,200 websites targeted across the United States, Canada, Australia and Japan.

Which named companies were confirmed as victims?

Deere, SharkNinja and Cummins are the three companies named in the Reuters report. The remaining victims among the “more than 100” have not been publicly identified.

How much did the campaign cost to run?

Reuters estimates the operator spent roughly $5,000 total on AI tokens across the campaign, which works out to about $50 for every successful breach.

Who discovered the campaign?

Snorre Fagerland, principal threat researcher at NorForge, is credited with identifying and tracing the campaign back to its operator.

Is the identity of the hacker known?

No. Reuters describes the operator only as Chinese-speaking. Whether this was one person or a small group has not been confirmed, and no arrest or formal attribution has been reported.

Is Cairn itself a hacking tool?

No. Cairn is described as a general-purpose, open-source AI problem-solving platform. It was reportedly repurposed to orchestrate reconnaissance and exploitation rather than built specifically for that purpose.

Did Anthropic or DeepSeek comment on the misuse of their models?

Neither company has published a detailed public response confirming what usage-monitoring or abuse-detection changes, if any, are planned following the Reuters report.

AI Agent Hacker Breaches 100+ Firms at $50 a Hit [2026]