A human-directed hacking campaign used AI agents to compromise more than 100 websites, according to findings by security firm NorForge reported on October 19. The campaign targeted e-commerce sites in the United States, Canada, Australia and Japan, but its full scale and the extent of unauthorized data extraction have not been independently established. (Reuters via Investing.com)

Reuters independently reviewed the attacker’s activity and identified Deere, SharkNinja and Cummins. Their responses describe materially different situations: remediation at Deere, a contained intrusion affecting a standalone SharkNinja support site, and an investigation into a potential attack on a third-party website associated with Cummins. (Reuters via Investing.com)

The central distinction is between a person directing malicious activity and software executing it. NorForge researcher Snorre Fagerland described agents carrying out complex intrusions without intervention after receiving instructions. That is a claim about automated execution—not evidence that an AI system independently decided to attack. (Reuters via Investing.com)

How the campaign came into view

Fagerland, NorForge’s principal threat researcher, told Reuters that he began finding inadvertently exposed instances of Cairn, an open-source AI problem-solving platform, around October 2. Those instances allowed him to observe malicious operators and the work they assigned to agents. He found about two dozen instances across several operators, not solely the featured campaign. (Reuters via Investing.com)

NorForge’s original investigation describes publicly accessible control panels that exposed targeting information and records of agent activity. The report provides a basis for examining what the systems were doing, although observing an attacker’s records is different from independently auditing every affected website. Its findings should therefore be read as a researcher’s investigation, not a complete victim-side assessment. (NorForge)

According to Reuters’ account, the featured Chinese-speaking operator began directing agents against e-commerce websites on September 25. By late in the week before October 19, the agents had attempted to break into more than 1,200 sites. That attempted-target figure must not be confused with the reported total of more than 100 successful compromises. (Reuters via Investing.com)

The numbers also describe websites, not a verified count of distinct corporate networks. Reuters said it established victim identities by reviewing Cairn activity, but it could not determine how extensively the breaches resulted in unauthorized data extraction. Its verification of particular identities does not independently validate the campaign-wide breach count. (Reuters via Investing.com)

What the companies said

Deere told Reuters it had taken necessary remediation actions and had no indication that sensitive information was accessed. That statement establishes the company’s reported response and current assessment; it should not be presented as proof that sensitive access was impossible or that every consequence had been ruled out. (Reuters via Investing.com)

SharkNinja told Reuters that the hack affected a standalone website containing only product support information and that the threat had been contained. Its account does not establish a compromise of the company’s broader internal systems or customer databases. (Reuters via Investing.com)

Cummins said it was investigating a report of a potential cyberattack on a website operated by a third-party vendor. The wording matters: the company described a potential incident under investigation, rather than confirming an intrusion into Cummins’ internal systems. These responses do not support treating all three companies as having suffered equivalent breaches. (Reuters via Investing.com)

What autonomy does—and does not—mean here

Reuters reported that the operator supplied preferred intrusion tactics in fewer than 100 Chinese characters and that successful intrusions typically took around 23 hours. Neither figure measures the complete human effort involved in preparing or running the campaign. A short instruction is not, by itself, a measurement of how independently an agent operated. (Reuters via Investing.com)

Fagerland estimated token spending at roughly $5,000, or about $50 per successful hack, and said the campaign appeared to use DeepSeek and Anthropic’s Claude Code. Those are attributed estimates and observations, not audited expenditure or a confirmed technical configuration. They cannot establish the total cost of the operation. (Reuters via Investing.com)

A separate precedent, not corroboration

There is relevant precedent, but not independent corroboration of this incident. In November 2025, Anthropic reported a separate espionage campaign using Claude Code against roughly 30 targets, with success in a small number of cases. It said human operators selected targets and built the attack framework, while AI performed much of the subsequent work. (Anthropic)

That earlier account illustrates why human direction and substantial automated execution are compatible descriptions. It does not validate NorForge’s count or establish an autonomy percentage for the Cairn campaign. The two investigations concern separate operations and should not be combined into a single measure of agent capability. (Anthropic)

What remains unresolved

The reviewed material supports reporting a human-directed, AI-assisted campaign and differentiated company responses. It leaves important questions unresolved: the complete breach count, the extent of data loss and how much human intervention occurred. No independent security expert assessment validating the campaign’s scale or autonomy was located for this article.