> ## Content Index
> Fetch the complete content index at: https://www.theglobalvoice.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI Agents Breach More Than 100 Corporate Websites
- URL: https://www.theglobalvoice.com/ai-agents-breach-more-than-100-corporate-websites/
- Published: 2026-10-20T07:00:42.000Z
- Updated: 2026-10-20T07:00:42.000Z
- Description: A hacker reportedly used AI agents to compromise websites belonging to more than 100 companies, including Deere and SharkNinja. Researchers uncovered exposed control panels that revealed how the automated attacks worked, with estimated AI computing costs of just $5,000.
- Author: TGV Desk
- Tags: United States, Artificial Intelligence, Cybersecurity, AI Agents, Cybercrime, Data Security, Technology, The Day So Far, Live Wire, has-audio

A hacker reportedly spent around $5,000 on artificial intelligence computing credits and gained access to websites belonging to more than 100 companies. The operation required surprisingly little hands-on hacking. Much of the work was assigned to AI agents that could inspect websites, identify weaknesses and attempt intrusions without constant human supervision.

The campaign, uncovered by cybersecurity firm NorForge, targeted more than 1,200 websites across the United States, Canada, Australia and Japan. Companies whose online properties were identified in the investigation included agricultural machinery manufacturer Deere, household appliance maker SharkNinja and engine producer Cummins.

The attacks offer an unusually detailed look at how AI is being used in cybercrime. Instead of manually investigating each target, the operator used Cairn, an open-source platform that coordinates AI agents to pursue specified objectives. The agents could work through multiple steps, exchange information and adjust their approach as they encountered obstacles.

The hacker's own security practices helped expose the operation.

NorForge principal threat researcher Snorre Fagerland discovered more than 20 Cairn control panels accessible through the public internet, many apparently associated with malicious activity. The dashboards revealed information about targeted websites, instructions given to agents and attempts to exploit vulnerabilities.

In its [October 19 technical investigation](https://norforge.com/blog/inside%5Fcairn?ref=theglobalvoice.com), NorForge documented how operators were using the platform to organise attacks, collect information and establish continued access to compromised systems. Some exposed dashboards also belonged to apparently legitimate security-testing operations, illustrating how poor configuration can expose sensitive information regardless of whether the underlying activity is authorised.

One of the largest malicious clusters contained 14 control panels and more than 1,100 projects. Many targeted online retail and payment infrastructure. Some agents attempted to install web shells, software components that can give attackers continued remote access to a compromised server.

NorForge also examined a case involving a hardware supplier in which unauthorised access to a session-storage system was used in an attack that resulted in a functioning web shell.

---

The financial cost was striking. Fagerland estimated that the most active operator spent approximately $5,000 on AI usage, equivalent to roughly $50 for each reported successful intrusion. That estimate excludes other expenses and should not be treated as a universal cost of compromising a website.

The affected companies have described varying levels of impact. Deere said it had found no evidence of access to sensitive information, while SharkNinja indicated that the incident involved a limited support website and had been contained. Cummins was investigating a possible incident involving a third-party service provider. The full extent of data access or theft across the campaign remains unknown.

India has encountered similar activity. In an [October 15 cybersecurity advisory](https://cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0049&pageid=PUBVLNOTES02&ref=theglobalvoice.com), CERT-In warned that criminal groups were using open-source AI agents against Indian organisations. Some attacks exploited exposed passwords, poorly secured cloud services and forgotten application interfaces, compressing intrusion timelines from days to hours.

Unlike the experimental AI behaviour involved in an earlier [unauthorised intrusion into an Australian government portal](https://www.theglobalvoice.com/openai-agent-bypassed-security-on-australian-government-portal/), the NorForge campaign involved a human operator deliberately directing AI systems towards unauthorised access.

The techniques themselves were largely familiar. Attackers still exploited vulnerable applications, exposed interfaces and weak access controls. What changed was the amount of work one person could delegate to software.

Companies accustomed to detecting and responding to intrusions over several days may now face automated attackers capable of probing hundreds of targets simultaneously, revisiting failed attempts and continuing their work long after the human operator has stepped away.