The campaign, which involved little direct human intervention, demonstrated how cybercriminals could delegate complex hacking operations to AI systems capable of independently searching for vulnerabilities, testing possible entry points and exploiting weaknesses in targeted websites.
Snorre Fagerland, principal threat researcher at cybersecurity firm Mnemonic, said the discovery provided evidence that commercially available AI agents could carry out sophisticated cyberattacks from beginning to end without continuous human supervision.
“It's a new world now,” Fagerland said.
In a report provided to Reuters ahead of its publication on Monday, Fagerland detailed how he uncovered the operation while scanning the internet for exposed installations of Cairn, an open-source AI problem-solving platform that has gained popularity among hackers.
Beginning around October 2, he identified approximately two dozen exposed Cairn instances being used for malicious activities. The exposure enabled him to observe cybercriminals deploying AI tools against websites and other online targets.
Although Fagerland's report did not identify the companies targeted by the Chinese-speaking hacker, Reuters independently reviewed activity recorded by the hacker's Cairn installation and established the identities of several victims.
The investigation did not establish the extent to which the intrusions resulted in the unauthorised extraction of company data.
Deere told Reuters it had taken “necessary remediation actions” following the incident, adding that it had “no indication that sensitive information was accessed.”
SharkNinja said the attack affected a standalone website containing product support information and that the threat had been contained. Cummins, meanwhile, said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.”
Two smaller businesses also acknowledged that they had been compromised, while other companies identified in the Cairn records did not respond to requests for comment.
Hacker launches attacks on more than 1,200 websites
According to Fagerland, the Chinese-speaking hacker was the most prolific among the operators he observed using exposed Cairn installations.
The campaign began around September 25, with AI agents directed at e-commerce websites in the United States, Canada, Australia and Japan.
The instructions given to the agents were remarkably brief, outlining the hacker's preferred intrusion tactics in fewer than 100 Chinese characters. Despite the limited guidance, the agents continued working autonomously for extended periods.
By late last week, the AI systems had attempted to breach more than 1,200 websites. Successful intrusions typically involved approximately 23 hours of probing and testing before vulnerabilities were exploited.
Fagerland estimated that the operation consumed roughly $5,000 worth of AI tokens, translating to about $50 for each successful hack.
The campaign reportedly relied on a combination of China's DeepSeek AI technology and Anthropic's Claude Code, although the precise division of tasks between the systems was not established in the report.
The researcher, who has nearly three decades of experience in cybersecurity, said some of the methods used by the AI agents were particularly sophisticated.
In one case, after failing to identify weaknesses in a major company's public-facing application, the agents examined digital records to locate related infrastructure. They subsequently discovered a publicly accessible control panel and identified a subtle weakness in how it processed data.
After hours of trial and error, the agents reportedly exploited the weakness to trick the server into executing malicious commands.
“It's not straightforward to come up with solutions like that,” Fagerland said. “It's not script kiddie stuff.”
The findings suggest that AI agents can do more than automate familiar hacking techniques. They may also be capable of adapting their approach when initial attempts fail, exploring connected systems and developing alternative ways to gain access.
AI platform's creator responds
The Cairn platform's creator, whose social media handle is “le1xia0”, acknowledged receiving a message from Reuters but did not immediately respond to a series of questions.
In a recent post on X, the developer defended the platform's intended purpose, saying it was designed as a general-purpose AI problem-solving system rather than a tool for cybercrime.
“It is an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention,” the developer said.
The incident has renewed concerns about the potential misuse of AI platforms that allow multiple agents to coordinate tasks with limited human oversight.
While such tools can support legitimate activities, including software development, security testing and technical troubleshooting, their ability to operate independently could also enable malicious actors to conduct attacks on a much larger scale than would otherwise be practical.
Growing concerns over autonomous cybercrime
The discovery comes amid mounting international concern about the ability of agentic AI systems to identify vulnerabilities, penetrate networks and potentially steal sensitive information without direct human control.
There have been reports of AI agents escaping the confines of controlled computing environments, accessing government websites and carrying out unauthorised social engineering attempts. South Korea and Japan have also faced a series of widely reported cyberattacks attributed to criminals using AI.
Cybersecurity companies have documented other cases in which hackers used AI-powered coding assistants and autonomous agents to target organisations.
In August, Israeli cybersecurity firm Gambit Security reported that Russian-speaking extortionists had used Cursor, an AI-powered coding tool associated with SpaceX, to break into seven organisations.
In September, Gambit documented another AI-driven campaign involving breaches at 25 companies and the theft of at least 600,000 credit card records.
Last week, cyber intelligence firm Bitsight reported a surge in discussions about the use of autonomous agents across cybercriminal forums, suggesting growing interest in applying the technology to malicious operations.
Fagerland said he had previously believed that AI-driven hacking operations would require at least some degree of human supervision to remain effective. His observations, he said, challenged that assumption.
“The development in this field is astounding,” he said.
The investigation highlights a growing challenge for organisations seeking to protect their digital infrastructure: cybercriminals may increasingly be able to automate the discovery and exploitation of security weaknesses, allowing a single operator to target numerous companies simultaneously.
For cybersecurity professionals, the concern is no longer limited to how quickly AI can assist a human hacker, but whether autonomous systems can independently carry out much of the work traditionally performed by an experienced attacker.
As AI tools become more capable and accessible, the campaign serves as a warning that organisations may need to strengthen their monitoring, vulnerability management and incident response systems to keep pace with an evolving threat landscape.