A Chinese-speaking hacker used an army of AI agents to target more than 1,200 websites and successfully breach over 100 entities, including John Deere and SharkNinja, according to research from AI security firm Norforge reported by Reuters and The Verge. The attacker spent roughly $5,000 in total to carry out the campaign.
The AI agents operated with little human involvement, automating the discovery and exploitation of vulnerabilities. This case highlights the growing threat of AI-powered cyberattacks, where relatively low costs can yield widespread damage across multiple countries.
How the AI-driven attack worked
Norforge discovered the attacks through exposed instances of Cairn, an open-source AI platform that describes itself as a 'general-purpose problem-solving engine.' Users set start and end points for AI agents, which then document their progress as they work. However, hackers can also use Cairn to orchestrate cyberattacks, as Norforge noted.
The most active attacker laid out 'preferred intrusion tactics' using fewer than 100 Chinese characters, according to Reuters. Successful breaches took about 23 hours each. Norforge found more than 20 exposed Cairn instances that are 'likely malicious.'
- Over 1,200 websites targeted; more than 100 breached.
- Victims include John Deere, SharkNinja, and Cummins.
- Attacker used fewer than 100 Chinese characters to outline tactics.
- Successful breaches took about 23 hours on average.
