One hacker's AI agents broke into more than 100 company websites at about $50 a time
On 19th Oct'26, Reuters reported that a single Chinese-speaking hacker used AI agents to break into the websites of more than 100 companies, including Deere, SharkNinja and Cummins. Snorre Fagerland, a researcher at NorForge, watched the campaign through exposed control panels for Cairn, an open-source agent platform. From 25th Sep'26 the agents tried more than 1,200 e-commerce sites, working for around 23 hours per break-in on instructions shorter than 100 Chinese characters, at an estimated $5,000 in tokens. SharkNinja said the site that was hit held only product support information, and Cummins is looking into a site run by one of its vendors.
What it actually means
The detail that matters is where the agents got in. When one large company's main application held up, they went looking for related infrastructure and found a public control panel with a weakness in how it handled data. The sites that fell were side doors, such as a product support site or a page run by a vendor, which nobody watches as closely as the main product.
At around $50 per successful break-in, nobody needs to pick you as a target, because it is cheaper to try everything. If your team has put up microsites, campaign pages or agent demos with admin panels facing the internet, list them this week and take down or lock away the ones nobody owns. Include the agent tools you run yourself, since this campaign was only spotted because the hacker left their own agent control panels open to the web.
At $50 a break-in, nobody needs to choose you as a target, because it is cheaper to try every site.
$50the estimated cost of each successful AI-agent break-in
Source: Reuters (via SRN News) · Tuesday, 20 October 2026