A hacker used AI agents to break into more than 100 sites; Microsoft launches tools to rein them in

AI agents on the attack — and AI agents on guard

Cybersecurity researcher Snorre Fagerland, a principal threat researcher at the firm NorForge, spent a couple of weeks watching a Chinese-speaking hacker break into the websites of more than 100 companies — including farm equipment maker Deere, home appliance company SharkNinja and engine manufacturer Cummins. That is the account in a Reuters report published Monday, October 19, 2026.

But the hacker did almost none of the work. Instead, he handed the whole campaign over to AI agents — systems that take a goal and carry out the steps on their own.

How the attack worked

Fagerland discovered about two dozen exposed instances of Cairn — an open-source AI problem-solving platform popular with hackers — being used for malicious activity starting around October 2. That let him quietly watch the hacker set the AI tools loose.

• The campaign began on September 25 and targeted e-commerce websites in the United States, Canada, Australia and Japan.
• The instructions given to the agents were terse — fewer than 100 Chinese characters.
• As of late last week, the agents had attempted to break into more than 1,200 sites. A successful intrusion typically took around 23 hours of probing.
• The whole campaign burned roughly $5,000 worth of AI tokens — about $50 per successful hack — using a mixture of China's DeepSeek and Anthropic's Claude Code.

In one case, after failing to find any weaknesses in a big company's public-facing application, the agents pored through digital records to find associated infrastructure, located a public-facing control panel, discovered a subtle weakness in how it processed data, and after hours of trial and error managed to trick the server into executing malicious commands. Fagerland said: "It's not straightforward to come up with solutions like that. It's not script kiddie stuff."

Reuters could not ascertain whether data was extracted. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack had hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was investigating "the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses also acknowledged being compromised.

Cairn's author, known as "le1xia0", told Reuters his platform "was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention."

Not an isolated case

Fagerland observed other hackers using Cairn: one stole a trove of credit card data, another tried to get AI agents to rob a cryptocurrency exchange. In August, security firm Gambit found Russian-speaking extortionists using the Cursor AI tool to break into seven organizations. In September, an AI agent-driven spree hit 25 companies and stole more than 600,000 credit card records. Cyber intelligence company Bitsight says discussions about using autonomous agents are surging across cybercriminal forums.

The other side: Microsoft reins in rogue agents

That same Monday, Microsoft announced new security tools to keep watch over AI agents as potential insider threats. According to GeekWire, the tools are part of the Microsoft 365 E7 bundle and the Project Perception security system.

The system continuously assesses each agent's risk — based on signals such as what data it can reach and whether its actions are starting to depart from the task it was given. When risk rises, the system can:

• take away the agent's ability to make changes while still letting it read data,
• require a person to approve a high-stakes step, or
• shut the agent down entirely.

Microsoft is also expanding its ability to find AI agents running on employees' computers — from 25 to 60 detectable agent types — including popular tools such as Claude Code, OpenAI's Codex and GitHub Copilot. It is adding "Guardian Agents" that investigate why an agent's risk changed and recommend or take steps to contain it.

The features are in private preview, with broader availability planned for the Ignite conference, November 17–19 in San Francisco. The E7 licensing level, launched in May, costs $99 per user per month and includes the Microsoft 365 Copilot assistant, the E5 toolset, Entra Suite and Agent 365.

The move follows an October 10 blog post by CEO Satya Nadella arguing that controls on AI models need to come from outside the models themselves: "The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least."

What does this mean for you?

Small businesses: The attack did not only hit big companies — two smaller businesses also acknowledged being compromised. If you have a business website, keep your software updated, use strong passwords and make regular backups. Ask your hosting provider about basic protection.

Consumers and money: More than 600,000 credit card records were stolen in one September spree. In Tanzania, fraud often targets mobile money — and AI that makes attacks cheaper can also make scams more convincing. Check your account statements regularly and never share your secrets with anyone who messages you asking for them.

Young people and students: A weekslong campaign cost just $5,000 — cybersecurity skills matter more than ever. The same AI agents used to attack can also be used to defend. Learning cybersecurity is a growing job opportunity.

Parents: AI can now do complex technical work on someone's behalf — including harmful work. Talk to your children about not trusting websites or messages that ask for personal information, and about not using AI tools to commit wrongdoing.