# One hacker's AI agents breached more than 100 company websites at about $50 in tokens per target, Reuters reports

Security firm Norforge traced more than 1,200 attempted intrusions to exposed control panels of an agent-orchestration system called Cairn. The finding came the same week Anthropic widened vetted access to its least-restricted cyber models.

- Published: 2026-10-20T06:12:48.347Z
- Canonical: https://polylog.news/ai/2026-10-20/one-hacker-s-ai-agents-breached-more-than-100-company-websit
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [Anthropic News](https://www.anthropic.com/news/cyber-verification-program)

A Chinese-speaking hacker directed AI agents that broke into more than 100 websites, including sites belonging to John Deere, SharkNinja and Cummins. The hacker spent roughly $50 in AI tokens per target and left almost all of the remaining work to autonomous software, according to a Reuters investigation published October 19 and [summarized by Quartz](https://qz.com/ai-agents-hacker-john-deere-sharkninja-cummins-breach-101926). Starting September 25, the agents attempted intrusions on more than 1,200 sites in the US, Canada, Australia and Japan ([AI Post](https://t.me/aipost/8536)). Each successful intrusion took about 23 hours.

Norforge, the security firm behind the finding, identified the activity through exposed control panels for Cairn, a system that coordinates agents to investigate a target, search for weaknesses and attempt a break-in. Norforge linked 14 panels and more than 1,100 attack projects to a Chinese-language cluster, [The Next Web reported](https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge). The named victims confirmed only limited effects. Deere said it had remediated the problem and saw no sign that anyone accessed sensitive information. SharkNinja said the attacker hit a standalone product-support site. Cummins said it was looking into a report about a site run by one of its vendors.

[Computing reported](https://www.computing.co.uk/news/2026/security/ai-agents-used-to-steal-credit-card-records) on a separate operation by a Chinese-speaking actor that combined three commercially available orchestration frameworks (Strix, Cairn and Hermes), stole more than 600,000 credit card records, and reached models through OpenRouter, including DeepSeek, Kimi and Claude Opus 4.6. The available reporting does not establish whether that operation is the same one Reuters described.

The source of each claim matters here. Norforge sells security services, and the scale figures come from its own telemetry. Reuters independently obtained statements from the named companies, and those statements confirm intrusions but describe only peripheral assets. The verified part is the economics: an agent pipeline can attempt intrusions against more than a thousand targets at a cost one person can pay.

Defensive tools in this space require vetted access. Offensive tools do not. On October 6, Anthropic [expanded its Cyber Verification Program (CVP)](https://www.anthropic.com/news/cyber-verification-program) into three tiers (Defense Access, Red Team Access and Specialized Access). Vetted security professionals get Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced blocking classifiers, [according to Crypto Briefing](https://cryptobriefing.com/anthropic-expands-cyber-verification-program-tiers-2/). Anthropic said partners in its earlier Project Glasswing found 129,000 verified vulnerabilities between April and July 2026, more than 33,000 of them rated critical or high severity. That figure is Anthropic's own and has not been independently audited.

## What this means

Agents have cut the marginal cost of an intrusion attempt to roughly the price of the tokens used. That shift changes which targets are worth attacking. Peripheral web properties, vendor-run sites and support portals were not valuable enough to justify a manual attack, and they are now cheap enough to attack with automated agents. Mid-market companies with large web estates are exposed, and so are the cyber insurers that underwrite them. Model aggregators occupy a new position in this picture, because they let an attacker switch between US and Chinese models from a single account. The precedent is Anthropic's November 2025 disclosure of a China-linked campaign that ran largely through Claude Code. Labs responded to that disclosure by tightening model-side classifiers, and this campaign evaded those controls by spreading its work across multiple vendors. Vetted programs such as the CVP give defenders better tools but do nothing about the volume of attacks. The likelier outcome is that within months, aggregators and API hosts face pressure from regulators and payment networks to apply know-your-customer checks, and insurers begin pricing exposure on web-facing assets separately. This reading depends on further incident reports confirming that agent-driven campaigns succeed against unmanaged assets at similar rates. Evidence that defensive agent scanning has sharply cut those success rates would prove it wrong.

## What to watch

- Whether OpenRouter or other model aggregators announce identity checks or abuse monitoring for high-volume accounts, because aggregators are where an attacker combines models from several labs.
- Whether more named companies confirm breaches tied to Norforge's Cairn cluster. Each confirmation tests the security firm's scale claims against independent evidence.
- Whether OpenAI or Google open a vetted cyber-access tier comparable to Anthropic's CVP. That would show labs converging on a gated model for offensive-capable features.