Article By David Lindfield
A single cybercriminal used autonomous artificial intelligence (AI) agents to attack more than 100 American companies, exposing how cheaply one hacker can now deploy sophisticated attacks against businesses around the world.
The campaign affected companies including John Deere, SharkNinja, and Cummins, according to Reuters.
The outlet reported findings from cybersecurity researcher Snorre Fagerland of NorForge.
The Chinese-speaking hacker targeted more than 1,200 e-commerce sites across the United States, Canada, Australia, and Japan.
Each successful breach cost approximately $50 in AI tokens, according to the report.
The findings reveal a dangerous expansion of criminal capability.
They reveal that a lone operator was directing swarms of automated agents that can search for weaknesses and carry out attacks around the clock.
Autonomous Agents Carry Out Sophisticated Attacks
Fagerland discovered that several malicious actors were abusing an open-source AI tool called Cairn to launch autonomous hacking campaigns.
The Chinese-speaking operator was the most aggressive of those he observed, Reuters reported.
Successful breaches occurred after the agents attacked different companies for approximately 23 hours.
The methods went beyond basic automated attacks, according to Fagerland.
“It’s not straightforward to come up with solutions like that,” Fagerland told Reuters.
“It’s not script kiddie stuff.”
One of the Cairn-assisted hackers Fagerland observed obtained sensitive credit card information, according to his report.
That finding was separate from the companies’ statements about what the Chinese-speaking hacker accessed.
“It’s a new world now,” Fagerland told Reuters.
Major Companies Respond to Breaches
John Deere said it had taken “necessary remediation actions” following the breach and found “no indication that sensitive information was accessed,” according to Reuters.
SharkNinja told the outlet that the hacker accessed a website that did not contain sensitive data.
Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.”
Those responses indicate that a successful intrusion does not necessarily mean sensitive customer or corporate information was stolen.
But the campaign demonstrates how one criminal can probe a large number of businesses at relatively little expense.
Cheap AI Expands the Reach of Cybercriminals
The same autonomous capabilities marketed for handling emails, scheduling appointments, and managing routine tasks are also being turned toward criminal operations.
Instead of personally conducting every step of an attack, a hacker can deploy agents to pursue vulnerabilities across hundreds of targets.
The approximately $50 token cost per successful breach underscores the imbalance facing businesses.
Sophisticated attacks can be cheap to launch while forcing companies to investigate intrusions, repair weaknesses, and determine whether information was exposed.
Fagerland’s findings show that the threat extends beyond one operator.
Multiple malicious actors were already using the same open-source tool for autonomous attacks.
For businesses responsible for protecting customer information and critical systems, AI-powered hacking is already an operational threat.
A single criminal is now able to launch attacks at a scale once far harder to achieve.
Be the first to comment