AI Agents Reportedly Helped an Attacker Breach Over 100 Websites

The Short Version

A Chinese-speaking attacker reportedly used AI agents to gain unauthorized access to more than 100 websites, according to Tom’s Hardware’s account of a Reuters investigation. Researcher Snorre Fagerland observed the activity through inadvertently exposed instances of Carin, an open-source AI problem-solving platform.

Why It Matters

The noteworthy detail is the sequence of tasks. In one reported case, agents searched digital records for infrastructure linked to a target, found a public-facing control panel, identified a weakness and used it to execute malicious commands.

That describes a connected intrusion process, rather than simply generating a piece of code. It illustrates how an attacker could delegate several stages of an operation, although this account does not measure how much faster those stages became.

The Bigger Picture

Access counts do not establish identical consequences for every target. SharkNinja told Reuters that its incident affected only a site used for product support information. The supplied report does not provide a complete victim-by-victim assessment.

The description of the actor as Chinese-speaking also does not establish nationality or a connection to a government. Those distinctions matter when interpreting a headline about a large campaign.

What to Watch

Further victim disclosures and independently documented intrusion details would help establish the campaign’s scope and damage. The available account does not quantify total losses or provide an independent comparison with attacks carried out without AI agents. Those gaps leave the reported use of agents clearer than their precise contribution to the outcome.

What evidence would help you judge how much AI agents changed the scale of these attacks?