AI agents hacked more than 100 company websites, researcher says
A hacker used autonomous AI agents to probe more than 1,200 websites and reportedly compromise over 100, according to NorForge research independently reviewed in part by Reuters. Several companies confirmed incidents or investigations, but the full victim list and extent of any data theft remain unknown.
What happened?
Confirmed reporting: Reuters reported on October 19, 2026 that NorForge principal threat researcher Snorre Fagerland observed a Chinese-speaking hacker directing autonomous AI agents against more than 1,200 websites, with over 100 reported successful intrusions. The campaign began September 25 and targeted e-commerce and company websites in the United States, Canada, Australia, and Japan. Reuters independently reviewed activity records to identify victims that NorForge did not name publicly. Company responses: Deere told Reuters it took necessary remediation actions and had no indication sensitive information was accessed. SharkNinja said the incident affected a standalone product-support site and was contained. Cummins said it was investigating a potential attack against a website operated by a third-party vendor. Two smaller companies also acknowledged compromise. Researcher assessment: Fagerland says the operator supplied short instructions and relied on a mixture of AI tools, including the open-source Cairn orchestration platform and models associated with DeepSeek and Anthropic's Claude Code, to perform much of the reconnaissance, testing, and intrusion work without continuing human supervision. Cost estimate: Fagerland estimated roughly $5,000 in AI-token spending across the campaign, or about $50 per reported successful compromise. Unresolved questions: Reuters could not determine how much data, if any, was taken from the compromised organizations. The complete victim list, vulnerabilities used across all sites, attacker identity, campaign objective, and exact degree of human intervention are not publicly established. This incident does not show that every AI coding tool or every Cairn installation is malicious.
How the technology works
At a safe defensive level, an AI agent can combine a language model with web browsing, command-line tools, code execution, and a memory or task system. An operator can give it a broad goal and let it repeat a loop: map a public website, inspect responses, test likely weaknesses, interpret failures, search for related infrastructure, and try another approach. According to the research described by Reuters, some agents continued working for about 23 hours on a target and adapted when the obvious path failed. That persistence and parallelism matter more than a single novel exploit. The campaign reportedly abused exposed systems and application weaknesses that defenders already need to control; AI made the process cheaper, more patient, and easier for one operator to scale. This article does not reproduce prompts, target lists, vulnerable endpoints, exploit chains, payloads, or instructions for using offensive agent frameworks.
Who is affected?
The confirmed or investigating organizations named by Reuters include Deere, SharkNinja, Cummins, and two smaller businesses, while NorForge's records reportedly contained more than 100 successful intrusions. Many targets were e-commerce sites, which can expose customer accounts, order data, payment integrations, administrative sessions, and third-party connections if compromised. However, no broad theft of customer information has been confirmed in this specific campaign, and Deere said it found no indication that sensitive information was accessed. Website owners, software-as-a-service providers, managed service providers, and vendors operating sites for other companies should assume that forgotten subdomains, support portals, staging systems, and public control panels will be tested continuously. Consumers should not assume their information was stolen merely because they have done business with a named company.
What should you do?
Organizations should inventory every internet-facing domain, subdomain, API, support site, staging system, administrative panel, and vendor-hosted property, then assign an owner and support status to each. Remove abandoned assets, restrict administrative interfaces to approved networks or a hardened access gateway, patch supported software, and replace components that no longer receive security fixes. Require phishing-resistant multifactor authentication for administrators, eliminate shared accounts, use short-lived credentials, and keep secrets out of public code and configuration files. Tune web application firewalls and bot controls for repeated low-and-slow probing as well as high-volume scans, but do not rely on blocking a claimed AI user agent because attackers can disguise traffic. Centralize web, identity, endpoint, DNS, cloud, and code-deployment logs so long-running activity can be correlated across systems. Alert on unusual enumeration, authentication attempts, new administrative users, unexpected file changes, suspicious server-side processes, and outbound connections from web servers. If compromise is suspected, preserve evidence, isolate the affected service, rotate reachable credentials and tokens, inspect connected systems, rebuild from known-clean sources when necessary, and notify affected people based on verified exposure. Consumers should monitor official company notices and financial accounts, use unique passwords with multifactor authentication, and treat breach-themed emails or password-reset messages as potential phishing; there is no evidence-based reason for every customer of a named company to replace a payment card now.
My analysis
My Analysis — opinion and inference: this campaign's most important lesson is economic. AI did not need to invent a magical new vulnerability; it gave one person the persistence and parallel labor that previously required a larger team. My inference is that routine web weaknesses, forgotten vendor sites, and incomplete asset inventories will become more dangerous because automated agents can revisit them for hours at very low cost. That is a forward-looking risk assessment, not proof that every organization is under autonomous attack. My privacy-first position is that companies should minimize the customer data and credentials reachable from public-facing systems, separate support sites from sensitive production records, and disclose confirmed exposure quickly instead of hiding behind uncertainty about whether the operator was human or automated. AI vendors and agent-framework developers should build abuse monitoring, spending limits, scoped tool permissions, and rapid suspension into their products, but responsibility also remains with the attacker and with organizations that leave sensitive systems unowned or unsupported. The defensive response should be verified hardening and transparent incident handling, not broad surveillance of employees or customers.
Why this matters
Cyber incidents often sound distant or overly technical. The important question is whether the same weakness, behavior, surveillance power, or exposure exists in systems you use. Facts and opinion are separated here so you can judge both clearly.
Facts, claims, and unknowns are separated above. Details may change as investigations and official statements develop.
Reuters: How one hacker used AI agents to break into scores of sites NorForge: cybersecurity and threat-research company ReliaQuest: AI agents and an exposed endpoint in a server compromise arXiv: LLM agents can autonomously hack websites