Chinese-Speaking Hacker Used AI Agents to Attack 1,200 Websites and Breach 100-Plus Companies Including Deere, SharkNinja and Cummins
A Chinese-speaking hacker used autonomous artificial-intelligence agents to attack more than 1,200 websites and break into sites belonging to more than 100 companies, including major American manufacturers Deere, SharkNinja and Cummins, according to cybersecurity research reviewed by Reuters. The most alarming part of the campaign was not simply the number of targets. It was how little human labor the attacker needed. Once given short instructions in Chinese, AI agents spent hours independently searching for weaknesses, testing exploits and attempting to establish access, reducing the estimated cost of a successful intrusion to roughly $50.
The operation represents a major shift in the economics of cybercrime. Highly capable hacking once required skilled operators to manually perform reconnaissance, study software behavior, test vulnerabilities and adapt when an attack failed. In this campaign, much of that work was delegated to autonomous software. NorForge researcher Snorre Fagerland said the agents were able to continue working for roughly 23 hours on successful intrusions, repeatedly changing tactics until they found a path into a target.
For American companies, that changes the threat calculation dramatically. Cybersecurity defenses have traditionally benefited from an asymmetry of cost: attackers may be able to scan many targets, but complex intrusions require time and expertise. AI agents can erode that advantage by allowing a single operator to run persistent attacks against hundreds or thousands of organizations simultaneously.
The Chinese-speaking operator identified by NorForge appears to have been the most prolific of several malicious Cairn users discovered by the company. Beginning around September 25, the attacker directed AI systems against e-commerce and corporate sites in the United States, Canada, Australia and Japan. By mid-October, the agents had attempted more than 1,200 targets.
The instructions reportedly given to the agents were remarkably short, sometimes fewer than 100 Chinese characters. From those limited commands, the AI systems could perform lengthy reconnaissance and exploitation workflows on their own. In one documented case, after failing to find an obvious vulnerability in a company’s main application, the agents searched associated internet infrastructure, discovered a separate public-facing control panel, identified a subtle data-processing weakness and eventually found a way to make the server execute malicious commands.
That capability should concern U.S. businesses because it demonstrates that AI agents are moving beyond simple automated vulnerability scanning. Traditional scanners can identify known weaknesses and generate alerts. These agents were reportedly able to reason through failed approaches, investigate alternative infrastructure and continue experimenting until they discovered a workable attack path.
The campaign appears to have used a combination of China’s DeepSeek technology and Anthropic’s Claude Code. That mixture is itself notable because modern cybercriminals do not have to build advanced AI from scratch. They can combine commercially available or open-source models, agent frameworks and inexpensive computing resources into automated attack systems.
The result is a dangerous form of technological leverage. A single individual with a few thousand dollars can now command an effective digital workforce capable of performing tasks that previously required a team of experienced hackers.
NorForge estimated that the campaign consumed approximately $5,000 in AI tokens. Spread across more than 100 successful compromises, that works out to roughly $50 per successful intrusion. For major American corporations that may spend millions of dollars securing networks, the idea that an attacker can generate persistent automated intrusion attempts for the cost of a restaurant meal per target illustrates how rapidly cyberattack economics are changing.
Named victims included Deere, one of America’s best-known agricultural equipment manufacturers; SharkNinja, a major consumer-appliance company; and engine manufacturer Cummins. Deere said it took remediation measures and had no indication that sensitive information had been accessed. SharkNinja said the affected site contained product-support information and that the threat had been contained. Cummins said it was investigating a possible attack involving a website operated by a third-party vendor.
Those responses show an important distinction. A successful compromise does not automatically mean that sensitive corporate information was stolen. Researchers could not establish how much unauthorized data extraction occurred across the broader campaign.
The threat remains serious because initial access is often the first step of a larger attack. Once attackers establish a foothold, they may attempt to steal credentials, plant malicious code, access payment systems, pivot toward internal infrastructure or preserve access for later exploitation.
NorForge observed other malicious Cairn users engaging in exactly those kinds of activities. One operator reportedly obtained large amounts of credit-card data, while another tried to direct AI agents against a cryptocurrency exchange. The Chinese-speaking operator’s campaign therefore sits inside a broader cybercriminal shift toward autonomous agents capable of carrying out extended attack chains.
For the United States, this development has consequences beyond ordinary corporate cybersecurity. American manufacturers, retailers, technology companies and industrial suppliers increasingly depend on web-connected infrastructure and third-party services. Attackers do not need to breach the most heavily protected internal server directly if an overlooked vendor site, management interface or support portal provides an easier entry point.
Cummins’ response is instructive because the company said the potentially affected website was operated by a third-party vendor. Supply-chain cybersecurity has long been an American vulnerability, and autonomous AI can make it easier for attackers to search systematically for the weakest company in a larger corporate ecosystem.
The attacker no longer needs to know in advance where that weakness exists. An AI agent can look for it.
This changes the scale of exposure for small and midsize businesses as well. Large corporations can afford sophisticated security teams and monitoring systems. Smaller vendors often cannot. If AI agents can autonomously probe hundreds of suppliers around a major American company, the weakest partner can become the most attractive route toward valuable infrastructure.
The Chinese-language dimension of this campaign deserves attention without overstating what the evidence shows. Researchers observed the operator issuing instructions in Chinese, and the campaign appears to have used DeepSeek alongside Claude Code. The public evidence does not identify the operator as a Chinese government actor. The documented concern is already substantial without making that leap: a Chinese-speaking cybercriminal demonstrated how inexpensive AI systems can repeatedly target American companies at industrial scale.
That development intersects with a broader U.S.-China technology competition. Chinese AI systems such as DeepSeek have spread internationally partly because of their relatively low cost and strong technical performance. Their availability also means advanced capabilities can be incorporated into cyberattack frameworks just as easily as they can be used for legitimate software development.
AI models themselves are general-purpose tools. What matters for American security is how cheaply malicious actors can turn those tools into scalable offensive infrastructure.
That reality should influence how U.S. companies think about cybersecurity investment. Defenses designed for a world in which attackers manually investigate one organization at a time may struggle against autonomous agents capable of running continuously across hundreds of targets.
Companies will need faster vulnerability remediation, stronger monitoring of internet-facing infrastructure, stricter third-party controls and better detection of automated reconnaissance. Security teams should assume that obscure systems once considered too unimportant for sophisticated attackers may now be worth attacking because AI has reduced the cost of investigating them.
The same logic applies to software vulnerabilities. A weakness that requires several hours of careful experimentation may once have discouraged less skilled attackers. An AI agent does not become tired, bored or frustrated. It can keep testing approaches for an entire day at minimal marginal cost.
That persistence is one of the most important lessons from the Cairn campaign.
The attacker did not need to personally understand every target’s infrastructure. The AI agents performed much of the exploration. Nor did the attacker need to supervise every failed attempt. The systems continued working independently until they succeeded or exhausted the available approaches.
That means the cyber threat is becoming less constrained by the number of talented human hackers available.
For the United States, the strategic concern is scale. America has millions of businesses, government contractors, hospitals, manufacturers and infrastructure operators connected to the internet. If one person can cheaply launch persistent AI-driven attacks against more than a thousand organizations, the number of potential attackers matters less than it once did.
A small number of operators can generate enormous attack volume.
The United States remains a global leader in artificial intelligence and cybersecurity, but technological leadership alone does not eliminate this problem. The same advances that make American developers more productive can also make foreign and criminal attackers more capable. Defending U.S. networks therefore requires treating autonomous offensive AI as an operational threat today rather than a theoretical future scenario.
The Deere, SharkNinja and Cummins incidents are important because they provide real-world evidence of that transition. The attacker did not merely ask a chatbot for hacking advice. AI agents reportedly conducted reconnaissance, discovered infrastructure, tested vulnerabilities and carried out intrusions with very limited human involvement.
That is a qualitatively different threat.
American companies should take particular notice of the price tag. About $5,000 was reportedly enough to finance an operation targeting more than 1,200 sites and compromising over 100. If those economics continue improving, attackers will have every incentive to run larger campaigns, maintain them longer and target companies that once appeared too small to justify the effort.
The central warning for the United States is therefore straightforward: AI has begun lowering the cost of sophisticated cyber intrusion faster than many organizations are lowering the cost of defense.
The Chinese-speaking hacker observed by NorForge offers an early example of what that new environment looks like. A human sets the objective. AI agents perform hours of technical work. American companies absorb the risk.
Cybersecurity teams should plan for a world in which the attacker is no longer one person sitting at one keyboard. One person can now command an automated digital workforce, and that workforce can attack American businesses around the clock.
