Autonomous artificial-intelligence agents attempted to break into more than 1,200 websites and succeeded against sites belonging to over 100 companies in a campaign that reportedly cost a single operator approximately $5,000 in AI computing tokens, according to a cybersecurity investigation published on October 19.
The companies identified by Reuters through its review of the attacker’s activity included farm-equipment maker Deere, consumer-appliance company SharkNinja and engine manufacturer Cummins. The scope of any stolen data remains unclear, and the companies gave materially different accounts of the affected systems.
The finding presents a new challenge for corporate cybersecurity budgets: an attacker no longer necessarily needs a large team to carry out persistent, multistage website intrusions. But the estimated spending is not a verified invoice or a universal price for hacking, and a compromised website is not automatically evidence that a company’s core production systems or customer records were stolen.
How Did One Operator Target More Than 1,200 Websites?
NorForge principal threat researcher Snorre Fagerland observed a Chinese-speaking attacker using AI agents through Cairn, an open-source problem-solving platform. In a Reuters investigation published October 19, the researcher said the campaign began around September 25 and targeted e-commerce sites across the United States, Canada, Australia and Japan.
The operator reportedly issued concise directions — fewer than 100 Chinese characters outlining preferred methods — and then allowed software agents to work autonomously. By late the preceding week, the agents had attempted intrusions into more than 1,200 sites. Successful penetrations typically followed around 23 hours of sustained investigation and testing, according to Fagerland.
Being Chinese-speaking describes the language of the instructions, not an independently established nationality, employer or state affiliation. There is no public evidence in the report tying the operator to the Chinese government.
The researcher estimated that the operation consumed around $5,000 in model tokens, averaging approximately $50 for each successful website compromise. That estimate concerns AI usage, not the attacker’s total expenses, and it should not be interpreted as the expected cost of compromising any arbitrary corporate target.
The campaign appeared to use a combination of DeepSeek and Anthropic’s Claude Code. The names identify tools apparently employed by the attacker; they do not suggest that either developer authorized the intrusions or that the models alone explain why some targets were vulnerable.
What Did Deere, SharkNinja and Cummins Say?
Reuters identified the named businesses by independently examining the attacker’s Cairn activity, rather than relying on a list of victims in Fagerland’s report. The publicly reported responses do not support treating all three as identical breaches.
Deere said it had taken remediation measures and found no indication that sensitive information had been accessed. That statement does not mean the website never required remediation; it speaks specifically to the absence of indications of sensitive-data access in Deere’s review.
SharkNinja said the intrusion concerned a standalone website containing product-support information and that the issue had been contained. The description points to a narrower exposed service rather than proof that the company’s broader operations, customer payment systems or internal networks were compromised.
Cummins said it was investigating a possible cyberattack against a site operated by a third-party vendor. That is not an admission that attackers entered Cummins’ own core systems. Two smaller businesses separately acknowledged compromises, according to Reuters, while other organizations did not provide responses.
Crucially, Reuters was unable to establish how much, if any, information had been taken from the named companies. A count of websites entered therefore cannot be converted into a count of customer records exposed, financial losses incurred or firms suffering a material operational shutdown.
Why Is the Agentic-AI Method Different From Automated Scanning?
Ordinary automated vulnerability scanning has existed for decades. The more consequential reported capability here is that software agents could investigate failure, revise their approach and continue testing a target with little direct guidance after their initial instructions.
Fagerland described one case in which the agents did not find a weakness in the principal public-facing application. They then examined related digital infrastructure, identified another accessible administrative interface and eventually found a way to exploit a weakness there. The reported sequence illustrates adaptive problem-solving across multiple stages without proving that every attempted intrusion used the same technique.
This kind of persistence changes how companies should evaluate neglected assets. A forgotten administrative interface, an exposed vendor portal or an older application can be more consequential than the newest customer website if attackers can systematically discover the relationship between them.
For financial firms, the concern is particularly relevant where customer services depend on layers of outsourced technology. In an unrelated incident, DriveWealth’s data-breach notifications to Revolut customers illustrated how third-party infrastructure may hold customer information after a client has stopped using the original financial service. That earlier case has not been connected to the AI campaign.
Did AI Agents Steal Credit Cards or Attack a Crypto Exchange?
Fagerland said the Chinese-speaking operator was one of several he discovered while scanning for unintentionally exposed Cairn installations. Starting around October 2, he observed roughly two dozen deployments being used for malicious activity.
Among the other activity the researcher described, one operator stole a substantial quantity of payment-card information, while another attempted to use agents against a cryptocurrency exchange. Those incidents should not be combined with the 1,200-site campaign or used to imply that the same attacker stole card information from Deere, SharkNinja or Cummins.
The attempted cryptocurrency-exchange operation also does not establish that any exchange suffered an actual breach or asset loss. No exchange was publicly identified in the account of that attempt.
Financial platforms face several distinct exposures: customer-information theft, unauthorized trading, interrupted services and compromise of transaction-authorization workflows. A previously documented Bitget backend-wallet security incident demonstrates the importance of protecting systems responsible for transaction authorization, but there is no evidence linking that case to Cairn or this operator.
What Does a $50 Estimated Breach Cost Mean for Investors?
The potentially disruptive feature of the findings is economic. When software can test many targets concurrently and revisit an unsuccessful approach without continuous human supervision, a smaller group of attackers may attempt a larger number of intrusions.
But cost estimates need context. Fagerland’s $50 average was derived from his model-token estimate and the number of reported successful website intrusions. It is not a market price for complete access to a listed company’s systems, and it does not include the cost of infrastructure, stolen credentials, evasion services, development time or eventual monetization.
For investors assessing a company after a security headline, the immediate questions are whether customer data was accessed, which assets were affected, whether services stopped, whether regulators require notification and whether recovery costs might be material. The presence of a recognizable company name in a list of websites is insufficient to calculate those impacts.
For banks, payment processors and brokers developing their own AI operations, the report also highlights the tension between legitimate automation and hostile use. As financial technology companies introduce AI assistants into regulated workflows, access controls, activity logs and limits on what automated agents may do become relevant not just to efficiency but also to security governance.
Boards and technology teams may need to pay closer attention to internet-exposed management interfaces, third-party services, unresolved high-severity vulnerabilities and detection systems capable of identifying persistent suspicious activity. Those are defensive priorities rather than evidence that any named company failed to implement them.
What Remains Unverified in the October 19 Investigation?
Fagerland’s underlying report was supplied to Reuters ahead of publication, and the news agency reviewed attacker activity to establish company identities. The available public account does not give readers a complete list of the more than 1,200 attempted targets, independently auditable success criteria for every intrusion or a full accounting of data taken.
Nor does observing the attacker use an open-source platform mean its original developer intended it for crime. Cairn’s creator publicly said the multi-agent architecture was not developed for harmful hacking and distanced himself from such use.
The clearest conclusion is that commercially available agents appear capable of performing prolonged, adaptive intrusion work on behalf of one operator at a comparatively modest estimated computing cost. Whether the campaign causes substantial financial damage to any of the named companies depends on facts that have not yet been established.
That distinction matters to investors: the number of attempted break-ins signals a threat that is becoming easier to scale, while the severity of any individual corporate incident still depends on what attackers actually reached and what happened afterward.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574