One operator used AI agents in a cyber breach of over 100 sites

An investigation by Reuters and the cybersecurity firm Norseforge uncovered a hacking campaign in which a single operator used AI agents to breach over 100 websites. The operator communicated in Chinese, and investigators tracked his activity through exposed dashboards of the "Kern" platform. Affected companies include Deer, Sharp Ninja, and Cummins; the extent of stolen data remains unclear.

An investigation by Reuters and the cybersecurity firm Norseforge has revealed a widespread hacking campaign in which a single operator used AI agents to breach over 100 corporate websites. The operator communicated in Chinese, but the investigation did not determine his identity or nationality, nor the extent of data that may have been stolen. Investigators were able to track the activity through exposed dashboards of the open-source "Kern" platform, which the operator left accessible online. The platform, used to coordinate software agents, is not limited to malicious uses. Reuters independently reviewed the activity and identified affected companies including Deer, Sharp Ninja, and Cummins. Deer stated it took corrective actions and found no indication of access to sensitive information; Sharp Ninja clarified the incident was limited to a separate product support site and was contained; Cummins said it is investigating a report of a potential attack on a site managed by an external vendor. Reuters could not determine the amount of data stolen. Norseforge reported finding over 20 dashboards likely linked to malicious activity, with financial motives and no clear signs of state sponsorship. The U.S. National Institute of Standards and Technology warns that granting AI agents broad permissions may allow them to use tools or data in unexpected ways.