One Hacker, AI Agents and About $5,000: How Deere, SharkNinja and Cummins Sites Were Breached

A single Chinese-speaking hacker used commercially available AI agents to attempt more than 1,200 websites and break into over 100 organizations, spending roughly $5,000 on tokens, according to a Reuters exclusive by Raphael Satter published October 19, 2026. Named victims include farm-equipment maker Deere, appliance maker SharkNinja and engine maker Cummins. The researcher who tracked the campaign, Snorre Fagerland of NorForge, says the agents ran the intrusions from start to finish with almost no human help.

This is the latest in a run of AI-agent security stories we have covered, from the Cursor agent that helped Russian-speaking extortionists breach seven companies to the Korean bank hacks tied to the Artex toolkit. What makes this one notable is the price tag and the paper trail: a researcher found the attacker's agent infrastructure exposed and could see the work being done.

Quick facts: what is reported, by whom

How the campaign was found

Fagerland did not start from a victim. He scanned the web for exposed instances of Cairn, an open-source AI problem-solving platform that Reuters describes as popular with hackers. Starting around October 2 he found about two dozen Cairn instances being used for malicious activity. One belonged to the Chinese-speaking hacker; another operator had stolen a large set of credit card data; a third tried to use AI agents to rob a cryptocurrency exchange.

His report did not name the victims. Reuters identified them by reviewing the hacker's own Cairn activity, which is a useful reminder of how this kind of research works: an attacker's careless server exposure becomes a public logbook.

Cairn's author, who goes by "le1xia0" on social media, did not answer Reuters' detailed questions but said the platform "was not designed for hacking attacks." Cairn is an open tool, much like the agent frameworks we track in our agent harness explainer: the same orchestration that lets a coding agent work for hours also lets an attacker point it at a list of targets.

What the agents actually did

The most useful detail in the story is how little instruction the agents needed. Reuters reports that the hacker's directions were under 100 Chinese characters, sketching only preferred intrusion tactics. The agents did the rest. Between the campaign's start on September 25 and late last week, they had attempted more than 1,200 sites, mostly e-commerce stores in the United States, Canada, Australia and Japan.

One case shows the pattern. After failing against a large company's public web application, the agents reportedly:

1. Looked for related infrastructure around the original target.
2. Found a public-facing control panel.
3. Exploited a subtle data-processing flaw through trial and error.
4. Tricked the server into running malicious commands.

Fagerland told Reuters this was not basic work. "It's not script kiddie stuff," he said, and he described the broader finding as evidence that AI agents can carry out complex intrusions without human involvement: "a new world now." He had assumed hacker agents would still need supervision; he said that is no longer true.

The $5,000 figure, in context

About $5,000 for 100+ compromises is the headline, and it deserves care. It is Fagerland's estimate of token spend, and it covers the campaign he observed, not the hacker's time, tooling or the failed attempts' value. The roughly $50 per successful hack is simply that total divided by the successes.

Even so, the order of magnitude matters. A skilled human penetration tester charges far more than $50 for a single engagement, and the agents ran in parallel against 1,200 targets. Our earlier piece on why AI agents keep ending up inside company networks argued that this economic shift, not any single exploit, is the real story. The cost curve of token spend is also what makes cheap open models like the DeepSeek line attractive to attackers and defenders alike.

Token tiles passing through an hourglass to show the low token cost of an AI agent hacker campaign

What the victims said

Reuters reports these responses:

• Deere took "necessary remediation actions" and said it had "no indication that sensitive information was accessed."
• SharkNinja said the hack hit a standalone site holding only product-support information and that the threat had been contained.
• Cummins said it was investigating a potential attack on a website run by a third-party vendor.
• Two smaller businesses acknowledged being compromised. Other victims in the Cairn data did not respond.

Note the pattern in those statements. Several of the compromised properties were peripheral: a standalone support site, a vendor-run page. Attackers do not need the crown jewels to cause trouble. A forgotten web property can hold customer data, credentials or a foothold into the main network. The primer on data breaches and API keys covers why those side doors matter.

Claimed versus verified

Language of a prompt is not proof of nationality, location or employer, so treat the "Chinese-speaking" label as a description of the instructions, not of a state or group.

Is this a one-off or a trend?

Reuters places the story in a longer sequence. In August, Gambit Security found Russian-speaking extortionists used a Cursor AI tool to breach seven organizations. In September, Gambit documented an AI-agent campaign that breached 25 companies and stole at least 600,000 credit card records. Hacks attributed to AI-using criminals have also drawn attention in South Korea and Japan, and Bitsight reported a surge in cybercriminal forum chatter about autonomous agents.

Policy is catching up slowly. Our report on the EU AI Office's formal probes into agent hacks covers one regulatory response, and the question of what a model provider owes when its product shows up in an attack is still open. If you use these tools legitimately, our Artex fork analysis shows how quickly an offensive wrapper appears around an open model.

For agent incidents that touch third parties, we keep a running list at /felony-bench.

What defenders can do

The Reuters article itself offers no recommendations, so the following is general hardening, not guidance from the researcher:

1. Inventory every public site, including marketing microsites, support portals and vendor-run pages. The weakest campaign victims were standalone sites.
2. Patch internet-facing admin panels first. The one detailed intrusion went through a public control panel.
3. Assume trial and error at machine speed. An agent will try hundreds of variations on an input-handling flaw. Rate limits, input validation and a web application firewall raise its cost.
4. Alert on unexpected command execution on web servers, not just on failed logins.
5. Review third-party vendors that host pages under your brand, since Cummins' statement points to a vendor-run site.
6. Watch your own agents. If your team runs coding agents, limit what they can reach and approve dangerous actions. AgentBeam, from the explainx.ai team, is a security platform built to stop AI agents before they take dangerous actions.

A gauge needle rising toward its limit, illustrating how an AI agent hacker campaign can scale

What to watch next

Three things will clarify the picture. First, whether Deere, SharkNinja, Cummins or the smaller firms file breach notices that say what data, if any, was taken. Second, whether DeepSeek or Anthropic comment on the model attribution and on account enforcement. Third, whether Cairn's maintainers add abuse controls or whether copycat toolkits fill the gap. We will add an update here if any of those land.

Bottom line

The verified core is modest but important: a researcher found a working, mostly autonomous intrusion operation, Reuters matched it to real companies, and those companies confirmed incidents of varying seriousness. The unverified parts are the scale of data loss and the exact models. The cost, if Fagerland's estimate holds, is the part defenders should plan around.

Related reading

• Cursor's AI agent and the seven-company breach
• Why AI agents keep hacking companies
• South Korea AI bank hacks and Artex
• Artex global edition fork
• EU AI Office probes into agent hacks
• What is a data breach
• What is an agent harness

Sources: Reuters exclusive via KSL, Insurance Journal syndication.

Details are accurate as of October 19, 2026 and are based on reporting that may be updated as victims and researchers say more.