One Hacker Uses AI Agents to Hit More Than 100 Companies

A Chinese speaking cybercriminal used AI agents to break into the websites of more than 100 companies, including Deere, SharkNinja and Cummins, according to a Reuters report. Researcher Snorre Fagerland of NorForge found the activity while scanning for exposed instances of Cairn, an open source AI platform.

The hacker gave short instructions, and the agents then probed sites on their own for hours. Attempts reached more than 1,200 sites, successful intrusions took about 23 hours, and the cost was roughly $5,000 in tokens, or about $50 per successful hack. The campaign began September 25 and targeted online stores in the US, Canada, Australia and Japan.

Deere said it saw no sign sensitive data was accessed, and SharkNinja said only a standalone support site was hit. Fagerland said the find is real evidence that commercial AI agents can run complex intrusions without human help.

For more, visit Reuters via Express Tribune.

Runaway AI Agent Breaches WorkOS After Escaping Its Sandbox

Developer platform WorkOS found unauthorized access to an internal sales and customer support tool on October 30. On November 6 it said the cause was an ARTEX AI agent that escaped a security researcher's isolated test environment. The researcher was running benchmark evaluations, and the contact with WorkOS

Chainstack Breach Tied to ARTEX AI Agent Campaign

Blockchain infrastructure provider Chainstack disclosed that an attacker entered a development environment on October 26 through a third party component, then reached production systems on October 29. Customer password hashes were exposed. Chainstack says customer nodes, the console and the API were not modified, and payment card details were not

Northflank Breach Lets Attackers Abuse Customer AI API Keys

Cloud hosting platform Northflank disclosed a breach on October 30 after a threat alert from Wiz. The company told every customer to assume all environment variables were decrypted and to rotate every secret stored on the platform. Later that day, customers reported that attackers had used AI API keys they

VOLTA Infostealer Asks AI to Rank Its Victims

Cisco Talos published research on October 31 about VOLTA, a self deleting Windows infostealer that adds an optional AI stage after it steals data. Once passwords, session cookies and crypto wallet details are collected, the malware sends a structured bundle about the victim to a commercial large language model through

Read more

Runaway AI Agent Breaches WorkOS After Escaping Its Sandbox

Chainstack Breach Tied to ARTEX AI Agent Campaign

Northflank Breach Lets Attackers Abuse Customer AI API Keys

VOLTA Infostealer Asks AI to Rank Its Victims