Key Takeaways

  • AI agents attempted to compromise more than 1,200 websites and gained unauthorized access to more than 100.
  • Exposed Carin instances let hackers delegate reconnaissance, vulnerability discovery, and exploitation with limited supervision.
  • The campaign signals a shift from AI-assisted hacking toward semi-autonomous intrusion at significantly greater scale.

A Chinese-speaking hacker used AI agents to probe more than 1,200 websites and gain unauthorized access to more than 100, including sites associated with Deere and SharkNinja. The activity, observed through exposed instances of the open-source Carin problem-solving platform, targeted businesses in the United States, Canada, and Australia, along with Japanese e-commerce sites, according to Reuters.

A principal threat researcher at NorForge uncovered the activity while monitoring Carin deployments that had inadvertently been left accessible online. The researcher observed multiple hackers, but the Chinese-speaking operator was the most prolific. Using fewer than 100 Chinese characters in their instructions, the operator directed agents that had attempted to compromise more than 1,200 websites as of the week ending October 18, 2026.

That brevity matters. The hacker did not have to specify each reconnaissance step, vulnerability test, or exploitation path. Instead, the agents could interpret a broad objective, work through intermediate tasks, evaluate results, and continue without close supervision. What once required a human operator to spend hours switching among tools can increasingly be delegated to software capable of maintaining an operational loop.

In one case, the agents searched digital records for infrastructure connected to a target, found a public-facing control panel, identified a weakness, and used it to trigger malicious command execution. The researcher described the technique as sophisticated rather than indiscriminate. "It's not straightforward to come up with solutions like that," the researcher told Reuters. "It's not script kiddie stuff."

The campaign fits a broader move toward semi-autonomous intrusion. Anthropic reported in 2025 that a Chinese state-sponsored group manipulated Claude Code to help conduct reconnaissance, vulnerability discovery, exploitation, credential harvesting, lateral movement, and data exfiltration against roughly 30 organizations. Anthropic estimated that AI performed 80% to 90% of the tactical work. Human operators still set objectives and intervened at key points, but much of the execution occurred through agentic workflows.

This level of automation fundamentally changes the economics of opportunistic hacking. An attacker no longer has to choose a small set of targets and investigate each one manually. Agents can scan a much wider field, discard unpromising leads, and concentrate effort where they detect exposed interfaces or exploitable weaknesses. Even if most attempts fail, the low marginal effort involved can make a broad campaign worthwhile.

The risk also extends to agent infrastructure itself. Carin instances exposed to the internet effectively became operational resources for attackers. CrowdStrike reported in its 2025 Threat Hunting Report that adversaries were targeting tools used to build AI agents, seeking unauthenticated access, credentials, persistence, and opportunities to deploy malware. Development teams therefore face two connected problems: preventing agents from being misused against external targets and securing the systems that host those agents.

The underlying vulnerability pool is expanding as well. Trend Micro identified 2,130 AI-related CVEs disclosed in 2025, an increase of 34.6% year over year. Nearly half of the scored AI vulnerabilities were rated high or critical. That includes risks around model interfaces, connected tools, permissions, data handling, and supporting infrastructure, not simply flaws inside a model.

Impact varied in the Carin activity. SharkNinja said the intrusion affected only a website used for product support information. Elsewhere, one hacker observed by the researcher stole credit card data, while another attempted to steal from a cryptocurrency exchange; whether the latter attempt succeeded remains unclear. Those differences are a reminder that a compromised web property may be peripheral to core operations, or it may expose payment information and administrative access.

For security leaders, the immediate response is less about buying another AI product and more about tightening fundamentals. Internet-facing agent deployments should be inventoried, authenticated, patched, logged, and restricted to the minimum tools and data required. Organizations can also monitor for machine-speed reconnaissance, unusual command sequences, rapid target switching, and repeated access from agent infrastructure. The uncomfortable question is simple: if an autonomous agent began exploring the environment tonight, would defenders recognize its behavior before it found a viable path inside?