Man uses AI agents to hack major companies
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
A Chinese-speaking hacker used AI agents to break into over 100 company sites, including John Deere's.
The attacks cost about $50 per breach, showing agents now run largely unsupervised.
Background
Snorre Fagerland, a threat researcher at cybersecurity company NorForge, found the campaign through exposed instances of Cairn, an open-source AI agent platform. AI agents — software that can carry out multi-step tasks on its own — are increasingly becoming staples of the cybercriminal underground, and Fagerland said he had previously assumed hacker-agents would need at least some supervision. The findings drew wider attention after Futurism reported them and CBS Mornings discussed unauthorized AI agent activity at U.S. banks.
How it unfolded
- Oct 19, 2026Reuters reported that Fagerland found a Chinese-speaking hacker used autonomous AI agents to break into more than 100 companies' sites, including John Deere, SharkNinja and Cummins.
- Oct 19, 2026The hacker gave the agents fewer than 100 characters of instructions and let them probe more than 1,200 e-commerce sites in the US, Canada, Australia and Japan; successful intrusions took about 23 hours of autonomous work, apparently using a mix of DeepSeek and Claude Code.
- Oct 19, 2026The whole operation burned roughly $5,000 in tokens — about $50 per successful breach.
- Oct 22, 2026Futurism reported the incident, noting the hacker is one of several malicious actors who abused Cairn.
- Oct 23, 2026CBS Mornings aired a segment saying major U.S. financial institutions face "unvetted and unauthorized AI agent activity."
Who’s saying what
- Expert
- Fagerland said "it's a new world now" and that the work is "not script kiddie stuff," adding that the technology had clearly moved past needing human supervision.
- Official
- John Deere said it took "necessary remediation actions" and saw "no indication that sensitive information was accessed"; SharkNinja said the accessed site held no sensitive data; Cummins said it was investigating a potential attack on a site run by a third-party vendor.
- Caution
- Axios senior AI reporter Madison Mills said major U.S. financial institutions face "unvetted and unauthorized AI agent activity," calling it "a nightmare" for banks.
Still unverified
Dealroom states the report points to a growing operational threat rather than an established major data breach; a tech commentator post names the autonomous agent 'Hermes Agent,' which other sources do not corroborate.