One Hacker, $5,000, and an Army of AI Agents Just Hit John Deere, SharkNinja and Cummins. The Script Kiddie Era Is Over.

The intrusion plan fit in fewer than 100 Chinese characters. The hardware doing the breaking was someone else’s laptop. Photo via Unsplash.

A single hacker used AI agents to break into more than 100 websites, including sites connected to John Deere, SharkNinja and Cummins, according to reporting by Reuters and The Verge on Monday. The campaign reportedly cost about $5,000 in model tokens and ran with little human involvement.

The number that deserves more attention is not the cost. It is the instruction: the hacker’s preferred intrusion tactics were described in fewer than 100 Chinese characters. The agents handled the rest. Successful breaches took about 23 hours each.

That is not a magic trick, and it is not evidence that AI has made every attacker a world-class operator. It is something more practical and more troubling: a small amount of direction can now set a capable system to work for hours, trying different paths until something gives.

The attackers left the door open on their side

Norforge researcher Snorre Fagerland found the operation while scanning for exposed Cairn instances. Cairn is an open-source problem-solving platform whose GitHub project describes it as a “general-purpose problem-solving engine.” A user sets an origin and a goal; agents work through possible paths and document what they find.

Norforge’s investigation identified more than 20 exposed Cairn instances likely tied to malicious activity. The hacker’s own infrastructure was exposed, letting researchers observe the work. That is why we know this campaign’s scale and methods. We are seeing the operators who leaked their logs, not necessarily the ones who secured their dashboards and kept quiet.

Reuters reported that the hacker targeted sites in the United States, Canada, Australia and Japan. More than 1,200 sites were reportedly targeted, with over 100 breached. The reported $5,000 figure comes from an estimate of token use, not an audited attacker expense report. Still, the basic math is hard to ignore: around 100 successful breaches, roughly 23 hours per success, and one human overseeing the operation.

The attack cost has fallen. The cost of investigating, containing and recovering from a breach has not.

“No indication” is a status, not a verdict

The three companies described the incidents differently. John Deere told Reuters it had taken remediation steps and had “no indication that sensitive information was accessed.” Cummins said it was investigating a potential cyberattack on a website operated by a third-party vendor. SharkNinja said the affected system was a standalone product-support site and that it had contained the threat.

Those are three different framings, but the reported targets share a notable trait: third-party or standalone web properties, not the companies’ core systems. That is exactly the tier of infrastructure many organizations treat as too unimportant to defend with the same rigor as production systems.

“No indication sensitive information was accessed” is a status update while logs are being reviewed. It is not a verdict. We have seen that phrase age badly in previous incidents this year. Reuters also said it could not establish whether the breaches resulted in unauthorized data extraction. For now, the companies’ statements do not settle that question.

This is the mirror image of the lab stories we have covered all fall, where agents escaped during testing. Here, agents were the workforce, not the accident.

OpenCode’s users paid for someone else’s model training

A second incident this Monday puts the risk closer to developers’ daily tools. OpenCode, an open-source, model-agnostic coding agent available through a terminal, desktop app or editor plugin, said a “large-scale distillation attack” affected 1.4% of OpenCode Console users who had linked external providers such as Anthropic, OpenAI and Google.

According to BleepingComputer, OpenCode notified affected users by email on Monday. The earliest possible exposure of stored API keys was October 17 at 00:30 UTC. The project said no data appeared to have been exposed beyond the keys.

Distillation itself is a legitimate machine-learning technique: a smaller model is trained using outputs from a larger one. It becomes an attack when someone makes large volumes of unauthorized queries, using another person’s API access and quota to generate material for training. The attackers are not merely borrowing a key. They are turning its owner’s account into their compute budget.

Users reported unauthorized charges ranging from several hundred dollars to more than $1,700 overnight. Some also reported Google Cloud projects suspended after Google detected “abusive activity consistent with hijacked resources.” OpenCode said it was working with Google, OpenAI and Anthropic, and might reimburse affected users.

The irony is hard to miss. OpenCode co-founder Dax Raad said attackers had been targeting the systems for at least 48 hours using AI agents. He also said OpenCode’s investigation was blocked when the models it was using began refusing requests because of built-in security safeguards. The defender’s tools refused to defend.

The investigation stabilized after OpenCode received approval on Saturday to use OpenAI’s Daybreak AI cybersecurity model. Read that again: safeguards designed to stop agents from doing harmful things also stopped defenders mid-incident, while the attackers’ agents kept working. That asymmetry is one of the clearest security lessons of 2026 so far.

API keys and cloud accounts are part of the new perimeter. Photo via Unsplash.

If your development tooling stores API keys for outside AI providers, assume those keys are targets. Rotate keys on any platform you cannot verify is storing them securely. Set spending limits and alert thresholds in every provider account. Check cloud billing and project status today. And make sure your incident-response plan has a fallback that does not depend on a model’s willingness to help.

The AI gateway problem is not theoretical

Check Point’s Monday threat report also flags critical issues in LiteLLM, a widely used open-source proxy between applications and AI providers. The report highlights CVE-2026-35029 and CVE-2026-59823, which could enable credential theft and request redirection. Check Point says the issues were fixed in later releases, so teams running LiteLLM should review the research and remediation guidance and update to a supported version.

Microsoft’s security team used its Monday blog to tell enterprises that “agents are your newest insiders.” That is vendor language catching up with a point we have been making for months: an agent with access to company systems is not just a clever chat window. It is an identity, a set of permissions and a path to data. Microsoft’s guidance recommends independent controls around agents, including scoped permissions and containment.

Meanwhile, the industry is moving quickly to build the agent economy. Reuters reports Nvidia has won Modal’s agent workloads for its Vera CPU. Amazon is challenging Nvidia’s software advantage with a new coding-language tool for its AI chips, as GeekWire reports. And reports point to Samsung and TSMC working together on high-bandwidth memory for Nvidia. The gap between building agent infrastructure and securing it is not an abstract forecast. It is what these two incidents look like in practice.

Four things to do this week

• Inventory AI provider keys. Find every place your organization stores them, including coding tools and third-party consoles. Rotate keys from affected platforms and revoke anything you cannot account for.
• Set hard spending limits. Configure spend caps and anomaly alerts on AI provider and cloud accounts. A stolen key can become a very expensive incident before it becomes a security alert.
• Audit the forgotten web properties. Review public-facing sites and vendor-run services with the same seriousness you give core production systems. Those were the kinds of properties hit in the reported Deere, SharkNinja and Cummins incidents.
• Rehearse without AI. Practice incident response using a fallback that does not depend on an AI model. A model that refuses to assist during an investigation is not a dependable single point of failure.

The bar for serious cybercrime is getting lower. The answer is not to panic about every agent, or to trust every vendor reassurance. It is to treat agents as capable, fallible systems that need narrow permissions, monitored credentials and a human-controlled way to stop them.

For more skeptical technology coverage, visit TechTime Radio’s blog, browse episodes, or listen live.