One Hacker Used AI Agents to Breach 100+ Company Websites for About $5,000 - Nationwide Private Investigator & Skip Tracing | Knoxville TN Background Checks & OSINT | Kyle's Investigation

A Chinese-speaking hacker used autonomous AI agents to attempt intrusions at more than 1,200 websites, successfully breaching sites tied to over 100 companies, mostly in the US, Canada, Australia and Japan, according to threat intelligence firm NorForge. Principal threat researcher Snorre Fagerland said the operators left their control panels exposed on the internet, allowing the activity to be observed. Reuters named Deere, SharkNinja and Cummins among the victims, though the extent of any data theft is unknown.

The campaign reportedly used Cairn, an open-source platform that gives AI agents a goal and lets them pursue it step by step. Instructions to the agents were minimal and in Chinese, typically directing them to run code on a shop and plant a web shell uploader. NorForge confirmed a break-in at a large hardware-parts vendor and a compromise at a very large US retailer, and documented an intrusion chaining unauthorized write access to a memcached session store, unsafe handling of saved PHP objects and a flaw in old Zend Framework code.

Economically, Fagerland said the campaign used about $5,000 in tokens, roughly $50 per successful hack, with successful intrusions averaging just under 23 hours; NorForge's own report is more conservative, putting the average at about $5 per task including failures and a success rate of around 10%. Fagerland found the activity by scanning for exposed Cairn panels beginning around October 2, and NorForge found hundreds of secrets via TruffleHog, 11% still valid. The three named companies said damage appeared limited, and defenders are advised to secure AI agent control panels, hunt for unexpected file-upload forms and use behavior-based monitoring.

(Source：KYLES INVESTIGATION)