{
    "format": "anawords-story/1",
    "docs": "https://anawords.com/data",
    "url": "https://anawords.com/story/hacker-ai-agents-breached-100-company-websites-norforge",
    "title": "Researcher says one hacker used AI agents to break into more than 100 company websites for about $5,000",
    "summary": "NorForge found the campaign through control panels left open online of an open-source agent tool. Deere, SharkNinja and Cummins responded to Reuters; how much data was taken is not known.",
    "section": "Safety & Trust",
    "type": "incident",
    "published": "2026-10-20T12:01:16+05:30",
    "updated": "2026-10-20T12:01:16+05:30",
    "version": 1,
    "author": {
        "name": "Mayank Sahu",
        "url": "https://anawords.com/author/mayank-sahu"
    },
    "how_checked": "Sources checked by AI; published under the editor’s standing approval. Not read line by line by a person before publication.",
    "ai_assisted": true,
    "research_note": "https://anawords.com/research/hacker-ai-agents-breached-100-company-websites-norforge",
    "labels": {
        "confirmed": {
            "name": "Confirmed",
            "meaning": "An official source says it: lab docs, pricing page, notice."
        },
        "reported": {
            "name": "Reported",
            "meaning": "Two or more independent, named outlets say it."
        },
        "claim": {
            "name": "Company claim",
            "meaning": "Only the company says it. Not checked by anyone else yet."
        },
        "unconfirmed": {
            "name": "Unconfirmed",
            "meaning": "One report only, shown with its source."
        },
        "unknown": {
            "name": "Not known",
            "meaning": "Not announced or not answered yet."
        }
    },
    "facts": [
        {
            "id": "f1",
            "text": "A Chinese-speaking hacker used AI agents to breach more than 100 company websites, per NorForge’s researcher.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": true,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f2",
            "text": "The agents targeted more than 1,200 sites.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": false,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f3",
            "text": "The researcher estimates about $5,000 in tokens, roughly $50 per successful hack.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": true,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f4",
            "text": "Deere, SharkNinja and Cummins responded; Deere saw no sign sensitive data was accessed.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": false,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f5",
            "text": "The campaign appeared to use DeepSeek models and Claude Code, per the researcher.",
            "label": "reported",
            "label_name": "Reported",
            "key_fact": false,
            "sources": [
                1,
                2
            ],
            "outcome": null
        },
        {
            "id": "f6",
            "text": "Average success rate of about 10%.",
            "label": "unconfirmed",
            "label_name": "Unconfirmed",
            "key_fact": false,
            "sources": [
                2
            ],
            "outcome": null
        },
        {
            "id": "f7",
            "text": "How much data was taken.",
            "label": "unknown",
            "label_name": "Not known",
            "key_fact": false,
            "sources": [],
            "outcome": null
        }
    ],
    "sources": [
        {
            "n": 1,
            "url": "https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html",
            "title": "Reuters (via Yahoo News): How one hacker used AI agents and a few thousand dollars to break into scores of sites",
            "type": "outlet",
            "checked": "20 Oct 2026",
            "archive": {
                "url": "https://web.archive.org/web/20261020063505/https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html",
                "archived": "2026-10-20T12:05:05+05:30"
            },
            "original_gone": false
        },
        {
            "n": 2,
            "url": "https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge",
            "title": "TNW: AI agents broke into 100+ sites for one hacker at $50 each, researcher says",
            "type": "outlet",
            "checked": "20 Oct 2026",
            "archive": {
                "url": "https://web.archive.org/web/20261020064108/https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge",
                "archived": "2026-10-20T12:11:08+05:30"
            },
            "original_gone": false
        }
    ],
    "promises": [],
    "prices": [],
    "incidents": [
        {
            "company": "Multiple companies (hacking campaign)",
            "product": "Cairn open-source agent platform, misused",
            "kind": "Security",
            "what": "A NorForge researcher says a hacker used AI agents to breach more than 100 company websites for about $5,000 in tokens; Deere, SharkNinja and Cummins responded.",
            "started": null,
            "ended": null,
            "duration": null,
            "official_status_page": null,
            "source": "https://www.yahoo.com/news/us/articles/exclusive-one-hacker-used-ai-100625247.html",
            "label": "Reported",
            "story": null
        }
    ],
    "image": {
        "url": "https://anawords.com/uploads/2026/10/hacker-ai-agents-breached-100-company-websites-norforge-16x9.webp",
        "kind": "illustration",
        "note": "Anawords illustration made by software from facts in the story. Not a photograph."
    },
    "changes": [
        {
            "version": 1,
            "date": "2026-10-20T12:01:16+05:30",
            "correction": false,
            "note": "First published. Research note published first. Sources checked by AI; approved for publication by the editor."
        }
    ],
    "license": {
        "facts_and_data": "Creative Commons Attribution 4.0 (CC BY 4.0)",
        "url": "https://creativecommons.org/licenses/by/4.0/",
        "article_text": "© Anawords. Quote with a link.",
        "attribution": "Anawords, https://anawords.com/story/hacker-ai-agents-breached-100-company-websites-norforge"
    }
}