Hacker used AI agents to break into over 100 company websites
A hacker used AI agents to break into websites of more than 100 companies, including Deere, SharkNinja and Cummins, according to Reuters, citing a security researcher. The AI did almost all the work on its own. The companies said the damage was limited or under review.
A Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins, by handing almost all the work to AI agents, according to Reuters, citing a cybersecurity researcher.
Snorre Fagerland, principal threat researcher at the security company NorForge, found the activity while scanning the web for exposed copies of Cairn, an open-source AI platform popular with hackers, Reuters reported. Fagerland's report did not name the victims, but Reuters said it identified them by reviewing the hacker's activity itself.
Beginning September 25, the hacker set AI agents loose on e-commerce sites in the US, Canada, Australia and Japan, Reuters reported. As of late last week, the agents had tried to break into more than 1,200 sites, and a successful break-in typically took about 23 hours, Reuters reported. Fagerland estimated the campaign used about $5,000 worth of AI processing, or about $50 per successful hack, Reuters reported.
Fagerland said the find was real evidence that commercially available AI agents can carry out complex break-ins from start to finish without human help, Reuters reported.
Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed," Reuters reported. SharkNinja said the hack hit a standalone product support site and that the threat had been contained, Reuters reported. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors," Reuters reported.
Cairn's author said in a post on X that the platform "was not designed for hacking attacks," Reuters reported.
What we know: Reuters reports that AI agents largely on their own broke into more than 100 company websites.
What we don't: Only Reuters has reported this so far; NewsHabit hasn't seen independent confirmation. It is not known how much data, if any, was taken.
Where outlets agree This is one outlet's report: Reuters is the only outlet NewsHabit has counted with its own reporting on the victims so far.
Where they differ Reuters reports the breaches based on a researcher's findings and its own review, while Deere says no sensitive information was accessed, SharkNinja says the threat was contained and Cummins says it is investigating.