One hacker, 1,200 targets: AI agents are turning cybercrime into an assembly line

• A Chinese-speaking hacker used autonomous AI agents to attack more than 1,200 websites and breach more than 100 of them, according to cybersecurity researchers.
• The agents reportedly did most of the reconnaissance and intrusion work themselves, often laboring for about 23 hours on a successful target with little additional human direction.
• The entire campaign may have cost only about $5,000 in AI processing — roughly $50 per successful intrusion — dramatically lowering the cost of large-scale cyberattacks.

Cybercriminals have been using artificial intelligence to write phishing emails, generate malicious code and automate routine hacking tasks for several years.

This is different.

A hacker recently turned loose autonomous AI agents against more than 1,200 websites and apparently let the software do nearly all the work — finding vulnerabilities, testing ways into systems and continuing to probe targets for hours without the hacker personally directing every step.

More than 100 company websites were successfully breached, according to a Reuters investigation based on research by cybersecurity firm NorForge. Victims included websites associated with Deere, SharkNinja and Cummins.

The campaign appears to represent an important shift from AI-assisted hacking to something much closer to AI-operated hacking.

Instead of a skilled attacker manually working on one company at a time, an individual can now give an AI system a relatively brief set of instructions and let it keep trying. And trying. And trying.

The machines don't get tired.

The hacker's instructions were remarkably short

Snorre Fagerland, principal threat researcher at NorForge, discovered the operation while examining exposed installations of Cairn, an open-source platform designed to coordinate AI agents through complicated tasks.

Beginning September 25, the hacker launched agents against e-commerce websites in the United States, Canada, Australia and Japan.

According to Reuters, the attack instructions were fewer than 100 Chinese characters long.

From there, the agents largely took over.

By late last week, they had attempted to penetrate more than 1,200 websites.

Successful attacks typically required around 23 hours of automated probing and testing.

Fagerland estimated that the entire operation consumed roughly $5,000 worth of AI processing tokens.

With more than 100 successful compromises, that works out to roughly $50 in computing costs per successful hack.

That economic equation may be the most important part of the story.

A human hacker can only spend so many hours testing targets. AI agents can work around the clock and simultaneously pursue large numbers of potential victims.

Even a relatively low success rate can become profitable if unsuccessful attempts cost almost nothing.

AI agents kept searching for a way in

Traditional automated cyberattacks frequently rely on scripts that look for a known vulnerability.

Agentic AI can potentially do something more sophisticated.

The NorForge research indicates that the agents could investigate a target, test alternative approaches when one failed, gather information about the system and continue working toward the hacker's goal.

In one case documented by NorForge, an agent reportedly chained together several weaknesses to gain command access to an online retailer's web server.

The researchers described the largest operation they observed as running more than 1,100 attack projects through 14 Cairn control panels.

NorForge estimated that roughly one in 10 attempts ultimately achieved the attacker's objective.

That kind of persistence used to require substantial human labor.

AI can make persistence cheap.

Deere, SharkNinja and Cummins were among the targets

Several prominent companies appeared in the attack data.

SharkNinja told Reuters that attackers reached a standalone website containing product-support information. The company said the incident had been contained.

Cummins said it was investigating a potential cyberattack on a website operated by one of its third-party vendors.

Deere said it took remediation measures and had no indication that sensitive information had been accessed.

Two smaller companies also acknowledged compromises, Reuters reported.

The full extent of any stolen information remains unclear.

That distinction matters. A successful intrusion into a website does not necessarily mean attackers obtained customer databases, passwords or financial information.

But other AI-agent operations observed by Fagerland were more explicitly criminal.

One attacker stole credit-card information.

Another attempted to use AI agents to steal cryptocurrency.

The software wasn't designed to be a hacking tool

Cairn is an open-source AI-agent framework intended to help artificial intelligence systems solve complex problems.

Its creator told Reuters that the system was not built for cybercrime and that malicious use represents abuse by its operators.

That's an increasingly important distinction in the debate over AI safety.

Many of the capabilities useful for legitimate AI agents are also useful to hackers.

An agent that can:

• browse websites,
• execute computer commands,
• analyze software,
• write code,
• remember what it has tried,
• adjust its strategy,
• and continue working without supervision

can be valuable for legitimate software development.

Point the same capabilities at somebody else's network, and the result can look very different.

AI Accountability Watch

The important change isn't smarter hackers. It's cheaper hacking.

The cybercrime industry has always depended partly on economics.

Attackers look for targets where the potential payoff exceeds the time and effort required to break in.

Agentic AI changes that calculation.

Consider what the NorForge numbers imply:

Targets attempted: more than 1,200

Sites reportedly breached: more than 100

Typical time spent by an agent on a successful intrusion: about 23 hours

Estimated AI-computing cost: about $5,000

Approximate cost per successful compromise: about $50

The agents can also pursue multiple targets simultaneously.

That means attackers may no longer have to decide whether a particular website is worth spending a day trying to penetrate.

They can simply add it to the list.

This isn't the first warning

Security researchers have been warning for some time that AI agents could eventually automate substantial portions of cyberattacks.

Some earlier incidents involved sophisticated state-backed attackers.

But the significance of the latest case is its apparent accessibility.

The operation reported by Reuters does not appear to have required a giant intelligence agency or a team of elite hackers.

NorForge found more than 20 exposed Cairn installations that appeared to be associated with malicious activity.

Several different operators were apparently experimenting with AI-driven cybercrime.

That suggests the technology may be moving from exceptional attacks toward something that ordinary cybercriminals can use.

What this means for consumers

Consumers aren't necessarily the direct targets in attacks like these.

Their data often is.

A vulnerable retailer, dealer, hospital, travel company or service provider may hold:

• names and addresses,
• email addresses,
• phone numbers,
• passwords,
• purchase histories,
• payment information,
• loyalty accounts,
• medical information,
• or other sensitive records.

If AI allows criminals to attack thousands of companies cheaply, even poorly defended small businesses become worthwhile targets.

That could mean more data breaches — and more raw material for identity theft, account takeovers and scams.

What consumers can do

Consumers cannot secure the companies holding their personal information, but they can reduce the damage if one of those companies is breached.

Use different passwords for important accounts. A stolen password becomes much more dangerous when the same credentials unlock multiple services.

Turn on multifactor authentication. This can prevent a stolen password from becoming an account takeover.

Be suspicious after a breach. Criminals frequently use stolen customer information to create convincing phishing emails, texts and phone calls.

Monitor financial accounts. Look for small unfamiliar transactions as well as large ones.

Freeze your credit if you don't need new credit. A freeze makes it much harder for thieves to open accounts in your name.

Don't assume a familiar company name makes a message legitimate. Stolen customer data can allow criminals to impersonate a company with unusually convincing details.

What businesses now face

The larger problem may be on the defensive side.

Most companies already receive enormous volumes of automated scans and intrusion attempts.

AI agents could greatly increase both the number and the quality of those attacks.

A conventional bot may try the same known exploit against thousands of websites.

An AI agent can potentially inspect what happens, change its approach and keep working.

That makes routine cybersecurity weaknesses — outdated software, forgotten support websites, poorly protected vendor systems and improperly configured cloud services — considerably more dangerous.

The Cummins case also illustrates another vulnerability: companies may be exposed through outside vendors rather than their own primary networks.

The next phase of cybercrime may be autonomous

Perhaps the most unsettling feature of the NorForge findings isn't that artificial intelligence discovered some revolutionary new hacking technique.

It didn't need to.

The breakthrough was automation.

A hacker supplied the goal.

The agents supplied the labor.

For roughly the price of a moderately expensive laptop, one person appears to have created a virtual hacking workforce capable of spending thousands of machine-hours attacking businesses around the world.

Cybersecurity has always involved a race between attackers and defenders.

AI agents may now be changing the arithmetic of that race — by giving attackers something they have never had before:

an inexpensive workforce that never sleeps.