AI Agents Broke Into 100+ Company Websites for $50 Each

A single hacker gave AI agents an instruction shorter than a text message and let them attack more than 1,200 websites on their own, Reuters reported on October 19, 2026. The agents broke into sites belonging to more than 100 companies, including farm machinery maker Deere, appliance brand SharkNinja and engine maker Cummins, for an estimated $5,000 in AI usage. That works out to about $50 for each successful break-in.

What happened

The campaign started on September 25, 2026. It came to light because the attacker made a basic mistake of his own: the control panels of the open-source agent platform he used were left open on the internet. Snorre Fagerland, principal threat researcher at the security firm NorForge, found them around October 2 and could watch the agents work in real time, according to Cyber Security News.

What he saw changed the economics of hacking. The operator wrote fewer than 100 Chinese characters of instructions, named a target and a goal, and walked away. The agents split the work, shared what they found on a shared project board and kept going. Successful attacks took just under 23 hours on average, and one ran for more than five days.

Fagerland was blunt about the skill level involved. "It's not script kiddie stuff," he told Reuters, as quoted by Tom's Hardware.

How the agents got in

None of the weaknesses were new. What was new is that software, not a person, worked through them patiently on site after site.

The flaw types on the list will sound familiar to anyone who has read a security report in the last 20 years: SQL injection (sneaking database commands into a form), unsafe file uploads, ways to skip a login, and outdated framework components. In one confirmed case the agents left a hidden upload tool, called a webshell, on a hardware vendor's site so they could come back later. The exposed panels also held hundreds of passwords and keys.

What the companies said

Deere said it took corrective action and found no sign that sensitive information was accessed. SharkNinja said the affected system was a separate product support site and the threat was contained. Cummins said it was investigating a possible attack on a website run by a third party. Reuters could not determine how much data, if any, was taken. Among the other attackers Fagerland watched, one stole credit card data and another went after a cryptocurrency exchange.

Why this matters for a small online store

For years, small businesses could assume they were not worth a hacker's time. That assumption is now wrong. When an attempt costs about $5 in AI usage, an attacker does not need to choose; the agents can simply try every store they find, and they never get bored on day three.

The good news is that the agents won with the same open doors that patient human attackers always used. Closing them is mostly housekeeping:

• Hosted store (Shopify, Wix, Squarespace and similar): the platform patches its own software. Your exposure is the apps and plugins you add, who can log in, and old copies of the site you forgot to delete.
• Self-hosted site (WordPress, WooCommerce, Magento, a custom app): you or your developer own every update, every admin page and every file upload form.
• Site you built with AI: run the security self-audit from our guide on whether vibe coding is bad before customers or payments touch it.

Use this list this week:

If you build or maintain your site with an AI coding tool, ask it to look for the same weaknesses the attackers used, before someone else's agents do:

Audit this website project for the weaknesses attackers' AI agents are using. Check:
1. Outdated packages, plugins or frameworks with known security flaws.
2. Admin, dashboard or test pages that anyone can reach without logging in.
3. File upload forms that accept files other than the types I need.
4. Forms or URLs that pass text straight into database queries.
5. Passwords, API keys or tokens written in files that are public or deployed.
Explain each finding in plain English, rank them by severity, and
don't change any code until I approve the fixes.

The bigger lesson is about the tools themselves. The agents that broke into these stores were built from the same parts that make AI useful for honest work: they read, plan, test and keep going without supervision. Our guide to what an AI agent is explains how they work, and how to build an AI agent without coding shows how to give your own agents only the permissions they need.