Ordinary criminals can now run hacking campaigns using cheap AI tools that a year ago they needed a government to achieve.
A report NorForge published Monday states that researchers found more than 20 control panels left open on the internet. They show who the hackers targeted and what they stole, and the targets include Deere, SharkNinja and Cummins.
How did AI hacking go from spy agencies to everyday criminals?
In mid-September 2025, Anthropic said it spotted odd activity that it was highly confident a Chinese state-backed group was behind. The group used Anthropic’s Claude Code tool to try to break into about 30 targets. These included large tech firms, banks, chemical makers, and government agencies. Anthropic said the break-ins worked in only a small number of cases.
Anthropic said the AI did 80% to 90% of the work while humans stepped in at only about four to six key points in each campaign. Anthropic called it the first documented large-scale cyberattack run without much human help. It shared the findings on November 13, 2025. It also said Claude sometimes made up findings, so humans had to check its work.
A year later, NorForge has published a report saying criminals can do something similar for far less money.
The security firm’s lead researcher, Snorre Fagerland, who has worked in the field for almost 30 years, began his search after Gambit Security published findings in September about a group using open-source AI tools named Hermes, Strix and Cairn.
Cairn is a free tool that anyone can download. A user gives it a target and a goal; the AI agents then hunt for weak spots and try to break in, sometimes for hours at a time.
Many users left Cairn’s web control panel open to anyone online. Fagerland used two scanning services, Shodan and Censys, to find more than 20 panels that he believed were used for crime.
The panels show who is being attacked, what weak spots were found, and which passwords and access keys were stolen. NorForge is hiding that data. It is also keeping the web addresses private until the panels are taken down.
Fagerland estimated that one campaign used about $5,000 in AI fees, which is about $50 for each site broken into. The hacker used a mix of China’s DeepSeek and Anthropic’s Claude Code.
Which companies were hit, and what did the hackers take?
Reuters reporter Raphael Satter looked at one of the panels and matched the activity to real companies. The busiest operator worked in Chinese, sending AI agents after more than 100 firms, including tractor maker Deere (NYSE: DE), appliance brand SharkNinja (NYSE: SN) and engine maker Cummins (NYSE: CMI).
The hacker wrote almost none of the code and limited their instructions to fewer than 100 Chinese characters. Starting September 25, the agents tried to break into more than 1,200 retail websites in the United States, Canada, Australia and Japan.
Each successful break-in took about 23 hours of automatic probing.
Deere said it has taken steps to fix the problem and so far has “no indication that sensitive information was accessed.” SharkNinja said the attack hit a separate product-support site and had been contained, while Cummins said it was looking into a possible attack on a site run by one of its outside vendors.
Other operators had different goals. One stole a large amount of credit card data while another tried to rob a cryptocurrency exchange using AI agents. The open panels also reveal stolen logins and keys.
NorForge sorted most of the activity into a few groups. The largest, called AIA0001, has 14 Chinese-language panels running more than 1,100 attack projects. Most aim at online stores and payment systems in the United States, Japan and Australia. NorForge said the goal is lasting access that criminals can cash in on later.
Cairn’s creator, who goes by “le1xia0” on social media, has said that the tool was not built for crime. In a post on X, they said it was “an innovative type of multi-agent architecture and was not designed for hacking attacks.”
Notably, the FTC sent legal demands to OpenAI and Anthropic on October 14 over safety incidents. Anthropic has also floated a draft bill to Congress that would let the government block any AI model that poses a risk of $1 billion in damages.
Both firms are also disclosing their own rogue-agent cases,
If you're reading this, you’re already ahead. Stay there with our newsletter.