One hacker's AI agents breached more than 100 company websites at about $50 in tokens per target, Reuters reports

A Chinese-speaking hacker directed AI agents that broke into more than 100 websites, including sites belonging to John Deere, SharkNinja and Cummins. The hacker spent roughly $50 in AI tokens per target and left almost all of the remaining work to autonomous software, according to a Reuters investigation published October 19 and summarized by Quartz. Starting September 25, the agents attempted intrusions on more than 1,200 sites in the US, Canada, Australia and Japan (AI Post). Each successful intrusion took about 23 hours.

Norforge, the security firm behind the finding, identified the activity through exposed control panels for Cairn, a system that coordinates agents to investigate a target, search for weaknesses and attempt a break-in. Norforge linked 14 panels and more than 1,100 attack projects to a Chinese-language cluster, The Next Web reported. The named victims confirmed only limited effects. Deere said it had remediated the problem and saw no sign that anyone accessed sensitive information. SharkNinja said the attacker hit a standalone product-support site. Cummins said it was looking into a report about a site run by one of its vendors.

Computing reported on a separate operation by a Chinese-speaking actor that combined three commercially available orchestration frameworks (Strix, Cairn and Hermes), stole more than 600,000 credit card records, and reached models through OpenRouter, including DeepSeek, Kimi and Claude Opus 4.6. The available reporting does not establish whether that operation is the same one Reuters described.

The source of each claim matters here. Norforge sells security services, and the scale figures come from its own telemetry. Reuters independently obtained statements from the named companies, and those statements confirm intrusions but describe only peripheral assets. The verified part is the economics: an agent pipeline can attempt intrusions against more than a thousand targets at a cost one person can pay.

Defensive tools in this space require vetted access. Offensive tools do not. On October 6, Anthropic expanded its Cyber Verification Program (CVP) into three tiers (Defense Access, Red Team Access and Specialized Access). Vetted security professionals get Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced blocking classifiers, according to Crypto Briefing. Anthropic said partners in its earlier Project Glasswing found 129,000 verified vulnerabilities between April and July 2026, more than 33,000 of them rated critical or high severity. That figure is Anthropic's own and has not been independently audited.