A major cyberattack targeting more than 100 companies across multiple countries allegedly carried out by an anonymous “Chinese-speaking” hacker who used autonomous AI agents has come to light, as per a recent cybersecurity report.
According to a news report in Reuters, cybersecurity firm NorForge first flagged the suspicious activities involving Cairn, an open-source AI problem-solving platform allegedly being used for malicious activities.
The affected companies included agricultural equipment manufacturer Deere, home appliance company SharkNinja and engine manufacturer Cummins. NorForge said they are coordinating with Reuters to inform the victims of the hack.
“More than 20 exposed Cairn panels were identified as likely associated with malicious activity, providing an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems,” read a statement from NorForge.
The hacker’s AI agents attempted to breach more than 1,200 websites. Successful intrusions typically involved approximately 23 hours of automated probing and testing to identify vulnerabilities. Fagerland estimated that the campaign consumed around $5,000 worth of AI tokens, amounting to approximately $50 per successful hack.
The report suggested that the operation used a combination of China’s DeepSeek and Anthropic’s Claude Code. In one instance, AI agents reportedly identified weaknesses in associated infrastructure after failing to find vulnerabilities in a company’s public-facing application, eventually discovering a way to execute malicious commands.
NorForge noted that while AI-driven frameworks are adopted by hackers, many a times, bad actors are themselves not well prepared for the technology.
“The attackers are not well prepared for this technology either. In the rush to gain quick results, many have forgotten basic security precautions, leading to them compromising their own operational security and also, unfortunately, exposing their targets to a far larger attack surface than the intent was,” read the report.
Also Read: After OpenAI, Anthropic and Meta, Google’s Gemini Hacked Firms during Cybersecurity Test
