A single hacker has used AI agents to break into more than 100 company websites, and the agents did nearly all the work. The victims include John Deere, SharkNinja and Cummins, and the hacker's tool is free for anyone to download. What this shows is that hacking is starting to work like spam: when each attempt costs a few dollars and no human attention, every site is worth trying.
The hacker wrote a short brief and the agents did the rest
The tool is Cairn, open-source software that was built first for security testing. You give it a target and a goal, and a team of AI agents works toward the goal, posting what each one finds to a shared board that the others can read. The hacker's preferred break-in methods took fewer than 100 Chinese characters to describe, about the length of a short text message.
The usual job was to find a way to run code on an online shop's server and leave behind a hidden upload page that keeps the door open for later. In one case the agents found no weakness in a company's public site, so they looked for a control panel linked to it, spent hours trying things, and finally tricked its server into running their commands. A successful break-in took a little under 23 hours.
The agents tried more than 1,200 sites and got into more than 100, about one in twelve. The researchers' rough estimate is $5,000 of AI usage in total, or about $50 per success. That matches an earlier test, where AI agents broke into five of a researcher's accounts for $210, about $42 each.
Old attack software skipped the hard sites, and agents do not
Automated attacks are not new. For years, programs have swept the internet checking every site for one known hole, and they only catch the sites that have it. A site that was kept up to date needed a person to sit with it for days, and that cost protected most mid-sized companies: they were never worth the time.
These agents do the sitting. If those 23 hours were a person's hours, 100 break-ins would be 2,300 hours, which is more than a year of full-time work. The hacker's campaign ran for about three weeks, because the agents work side by side and an hour of their work costs about $2.
The targets were chosen like a mailing list: online shops in the US, Canada, Japan and Australia with plenty of visitors, fed to the agents by an automated pipeline. The aim looked like lasting access to shop and payment systems for later use.
The weak spot is the site nobody thinks about
A furniture retailer, for example, might run its main store on a well-maintained platform. It also has a warranty registration page that an agency built years ago, and a quote form hosted by a supplier. A human hacker who looks at that company sees a hard main site and moves on. An agent spends a day on every page in the list, and the forgotten page is the one that gives way. If that page shares logins with the shop or connects to its systems, it is the way in.
The two cases we know of look like this. SharkNinja's was a standalone product support site, and Cummins is looking at a site that one of its vendors operates. Neither is the front door that the company's security team watches.
Defenders can hire the same agents
Cairn was made for security testing, and some legitimate testing firms use it too. The tool does not care who owns the target, so a company can hire a testing firm to point agents at its own sites. At about $5 a try, which is the average once failures are counted, checking 20 sites costs around $100 in AI usage, plus the time of the person who sets it up and reads the results.
The first step needs no AI. Write down every website that carries your company's name, including the ones an agency or supplier runs for you, and close the ones nobody uses. Anything still on that list is something an agent can spend a day on, so the list is the place to begin.