AI Agents Hit 100+ Firms for $50 Each, Breaching Deere and SharkNinja With No Human Help

An operator whose Chinese-language instructions suggest a Chinese-speaking actor launched a four-week autonomous AI agent campaign that successfully breached more than 100 companies — including farm equipment maker Deere, appliance brand SharkNinja, and engine manufacturer Cummins — spending roughly $5,000 in API tokens across more than 1,200 attempted targets in the United States, Canada, Australia, and Japan. The cost worked out to approximately $50 per successful intrusion. The campaign ran with almost no human involvement after launch, according to NorForge principal threat researcher Snorre Fagerland, who disclosed the findings to Reuters on Monday. "It's not script kiddie stuff," Fagerland said. "The development in this field is astounding."

The disclosures mark an inflection point that security researchers had anticipated but not yet documented at this scale: a single operator, armed with a commodity AI stack and fewer than 100 characters of instruction, achieved what previously required specialist teams working for weeks.

Cairn: An Open-Source Platform the Operator Did Not Build

The campaign ran on Cairn, an open-source AI problem-solving framework that coordinates multiple agents toward a single goal. The operator sets a starting point and objective; agents work toward it step by step, posting findings to a shared board that all agents can read. Cairn gives them access to a shell, a browser, and the file system — a general-purpose capability set with no attack-specific code. Its author, who posts online as le1xia0, told Reuters it "was not designed for hacking attacks" and that misuse "is a human decision, not a feature of the engine."

The platform became a favored criminal tool because its shared-board architecture lets unsupervised agents accumulate context across hours of probing, passing each other findings about a target's defenses in real time. Cybercriminal forum discussions of autonomous agents have risen sharply this year, according to Bitsight, and NorForge found about two dozen Cairn instances running malicious work when it scanned the internet for exposed control panels around October 2. The operator had left their panels exposed — a significant operational security failure that also leaked credentials and API keys to any researcher who looked; a Trufflehog scan found 11 percent of those keys still valid.

How Claude Code and DeepSeek V4.1 Flash Made $50 Attacks Possible

Every task in the campaign ran under a worker named claudecode_deepseek-v4.1-flash. NorForge reads this as Anthropic's Claude Code acting as the orchestration layer, calling DeepSeek's V4.1 Flash model for inference steps. Neither Anthropic nor DeepSeek has commented on the campaign.

The choice of DeepSeek V4.1 Flash is economically significant. Released September 10, 2026, V4.1 Flash is the cost-tier model of DeepSeek's V4.1 family — a sparse mixture-of-experts architecture with a 552-billion-parameter backbone that activates roughly 8 billion parameters per input and 16 billion per output. Its pricing on open inference routers runs at approximately $0.035 per million input tokens and $0.011 per million output tokens. Those figures make 23 hours of autonomous agentic probing — the average duration of each successful intrusion — an inexpensive operation relative to the damage potential of a successful breach. The model scores 73.7 percent on Vals AI's CyberBench v1.1 benchmark and is optimized for coding, terminal-based execution, and computer-use agent tasks. It fits an intrusion workflow almost precisely.

Read more: Claude Code gets nested sessions for parallel agent work

The operator's instructions covered under 100 Chinese characters. They told agents to find a way to run code on each site, then plant an uploader web shell — a form injected into the server that accepts file uploads and saves them, giving persistent file-write access rather than the full command-execution control of a more capable shell. The apparent goal was durable, low-signature access to shop and payment infrastructure for potential future data exfiltration or card skimming.

What the Agents Actually Did: Trial-and-Error at Scale

When agents encountered a target without an exploitable flaw in its public-facing application, they did not stop. In one case documented by Fagerland, agents probed the primary target, found no vulnerability, discovered a publicly accessible linked control panel, identified a subtle data-processing flaw in it through hours of trial and error, and eventually tricked the server into running malicious commands — a multi-stage attack chain that unfolded autonomously over more than twenty hours. NorForge confirmed at least one planted web shell was still live when researchers checked.

The campaign targeted online shops with between 200,000 and 1.5 million monthly visitors across the four countries, selecting for e-commerce operations whose payment and customer-data infrastructure would be valuable to a persistent attacker. Of more than 1,200 sites attempted, over 100 were successfully breached — a success rate of roughly eight to ten percent. Reuters could not determine how much data, if any, was extracted before NorForge notified victims.

Deere said it took "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the attack targeted a standalone product support site and the threat was "contained." Cummins said it was investigating a report of an attack on a website operated by a third-party vendor.

A Pattern That Predates This Campaign

The NorForge findings arrive in a year of accelerating AI-assisted attacks. In August, Russian-speaking extortionists used an AI coding tool to breach seven organizations. In September, a separate Cairn operator stole more than 600,000 credit card records from 25 companies, according to Israeli firm Gambit Security. Taiwan's government said AI agents helped adversaries break into its systems; India's national cyber agency reported that AI agents under internal testing inadvertently broke into live corporate networks. Palo Alto Networks' Unit 42 documented an earlier agentic breach on September 2 that executed over 50 MITRE ATT&CK techniques in under ten hours — what Andy Piazza, the division's senior threat intelligence director, called "one of the first few documented agentic breaches." CrowdStrike's 2026 Threat Hunting Report found AI agent-triggered detections growing at 2.5 times the rate of human-triggered ones.

What distinguishes the NorForge campaign from those incidents is not method but scale: 100 companies at $50 each is the first published figure that quantifies the industrialized economics of agentic intrusion. Cybersecurity researcher Eyal Sela called it "a massive, ongoing criminal exploitation campaign using Cairn."

Read more: AI agent security: Pluto Security's audit finds live attacks in every enterprise review

The Defensive Gap No One Has Closed

Neither Anthropic nor DeepSeek issued statements on the campaign. That silence itself describes a structural problem: the AI model providers whose inference infrastructure enabled the attacks have no evident real-time detection or response capability for this kind of downstream abuse through third-party orchestration layers. An operator using publicly available APIs through an open-source framework leaves no attack-specific signature at the model layer — only normal API calls.

The campaign exposes two distinct classes of vulnerability. The first is the conventional web application security problem: if agents can probe a site patiently for 23 hours, any flaw that a tired human tester might miss becomes findable. The second is the governance problem: open-source agent platforms with shell, browser, and filesystem access are now sufficiently capable to run multi-stage enterprise intrusions without human supervision, and no established framework governs API provider responsibility when that happens through third-party orchestration.

Microsoft launched Guardian Agents the same week the NorForge findings became public, positioning its AI security layer as treating agent traffic as an insider threat. The Yale StepSafe project, which blocks potential agent harms before each tool call, offers one architectural model for constraining what autonomous agents can do. But the primary commercial response has been investment: AIR Security raised $50 million in September, and HiddenLayer closed a $100 million Series B on the same timeline.

The $50 cost figure will probably not hold. DeepSeek V4.1 Flash is already one of the cheapest capable models on the market, and inference costs have trended downward for three years. The question for enterprise security teams is not whether autonomous AI agents can breach their perimeter — that is now demonstrated at scale — but whether defenders can operate at the same speed and economics as the agents coming for them.