A Chinese-speaking attacker used autonomous artificial-intelligence agents against more than 1,200 websites and compromised over 100 of them, demonstrating how quickly offensive automation can expand the reach of a relatively small operation. The campaign affected sites associated with companies including Deere, SharkNinja and Cummins, though the evidence does not establish that data was extracted from every victim. Individual successful compromises took about 23 hours and were estimated to require roughly $50 in model usage. The episode shifts the AI security debate from hypothetical capability to an operational campaign with measurable scale, cost and corporate impact.
What AI agents cyberattack Confirms
Autonomous agents can maintain a chain of tasks, allowing reconnaissance, vulnerability testing and exploitation attempts to continue with less constant human direction.
Targeting more than 1,200 websites does not mean every attempt succeeded, but the volume shows how automation can make broad campaigns economical for a single operator.
More than 100 reported compromises create a serious incident even without proof of universal data theft, because unauthorized access can enable persistence, manipulation or later attacks.
Why AI agents cyberattack Matters
Deere said it found no indication that sensitive data was accessed, a company-specific conclusion that should not be generalized to every victim in the campaign.
SharkNinja contained an attack affecting a product-support site, illustrating how secondary web properties can become entry points even when core commercial systems remain protected.
Cummins was investigating a site connected to a third-party vendor, highlighting the supply-chain challenge of defending services that carry a company's name but sit outside direct infrastructure.
The Wider Context Around AI agents cyberattack
An estimated $50 in model usage per successful compromise changes attacker economics, although labour, preparation, infrastructure and failed attempts mean total campaign cost was higher.
The roughly 23-hour compromise timeline is fast enough to pressure defenders whose alert review, vendor contact and patch approval still operate through slower organizational processes.
Companies need asset inventories that include forgotten microsites and support portals, since autonomous attackers benefit from every unmanaged system exposed to the public internet.
What Comes Next for AI agents cyberattack
Defensive teams can also use automation, but controls must require validation so security agents do not create outages or mistake normal customer behaviour for malicious activity.
Model providers face questions about abuse detection and account controls, yet responsibility remains distributed across users, hosting services, software vendors and targeted organisations.
The campaign's central warning is practical: AI has lowered the cost of persistence, making basic patching, vendor governance and rapid containment more urgent rather than obsolete.
The investigation published on 19 October describes more than 20 exposed control panels assessed as likely malicious. It separates activity into several clusters rather than treating every panel as one attacker. The busiest Chinese-language cluster had more than 1,100 projects across 14 dashboards. These are observed projects, not a count of independently verified data thefts. Some legitimate security-testing panels were also exposed, putting client information at risk even where the testing itself was authorized.
The cost estimates are not invoices or complete token records. Around $5 per task includes unsuccessful, early-ending projects, while a successful compromise has a different denominator. The average time to a completed goal was just under 23 hours for the busiest cluster, with a wide range that included a project lasting more than five days. The outcomes therefore describe a snapshot of particular operators and tools, not a universal success rate for AI attacks or proof that every named company suffered the same harm.
The exposure creates a second risk beyond the original intrusions. The investigation found hundreds of credentials and other secrets in the panels, with 11% validated by a scanning tool. That percentage applies to the collected secrets, not to targeted websites or victims. Exposed material included findings produced by agents and credentials supplied by human operators. Even an unsuccessful authorized test could therefore reveal information about a client if its control panel was left open. The report did not establish that every exposed secret had been exploited.
The visible interfaces also appeared to include administrative controls for stopping or restarting projects, adding information and redirecting agents. Those controls were not tested without authorization, so their appearance is not proof that a stranger could successfully take over an operation. The investigators withheld sensitive panel addresses and said they were notifying affected organisations and seeking takedowns. Whether a panel was removed depended partly on the hosting provider's response. These limits matter when distinguishing observed exposure, a claimed intrusion and a separately validated compromise.
PUBLISHED BY SUYASH PACHAURI, FOUNDER & OWNER, GLOBAL BOLLYWOOD | THE HOLLYWOOD SCOPE