What happened
On 19 October Reuters published an exclusive that many in security had long been dreading. A Chinese-speaking attacker set AI agents loose on online stores and got into the websites of more than 100 companies, including Deere, SharkNinja and Cummins.
It was uncovered by Snorre Fagerland, a researcher at the cybersecurity firm NorForge. While searching the internet for poorly protected installations of Cairn, an open-source platform for coordinating AI agents, he found several being used for attacks. From early October he was able to look, quite literally, over the attackers' shoulders.
The numbers that change the maths
The unsettling part isn't that AI can be used to attack. It's how little it costs and how little the human has to do.
- More than 1,200 websites attacked since 25 September, mostly online stores in the United States, Canada, Australia and Japan.
- More than 100 successful intrusions.
- About 5,000 dollars in tokens for the whole campaign, which works out at roughly 50 dollars per compromised site.
- A little under 23 hours on average per intrusion, with the agents working on their own.
- Fewer than 100 Chinese characters of instructions. The attacker described their preferred tactics and let the agents do the rest.
How they got in
These weren't textbook attacks. The agents looked for control panels reachable from the internet, found a subtle flaw in how they processed data and got the server to run commands. When the main application was well protected, they explored the surrounding infrastructure until they found a door that was less well locked.
Fagerland summed it up by saying this was not amateur work. Until now he thought this kind of attack needed a human supervising. Not anymore.
There's a detail we think matters for a small business. In two of the known cases, the site attacked wasn't the main one: SharkNinja says it was a separate product support site, and Cummins refers to a website run by an outside vendor. All three companies say they have contained the problem.
Why this concerns you too
Until now, many small businesses reasoned like this: "we're small, nobody is going to waste their time on us". It made sense. Attacking a website by hand takes hours of someone who knows what they're doing, and that only pays off with big targets.
With agents, that logic breaks. If getting into a store costs 50 dollars and no hours of human work, it pays to try thousands at once and keep the ones that give way. You're no longer picked for being interesting. You're picked because you're on the list and something on your site hasn't been updated.
Reuters also reports that other attackers using the same tools stole credit card data and tried to drain a cryptocurrency exchange. For an online store, that's a legal and reputational problem, not just a technical one.
What I would do this week
None of this is new in security. What's new is that it can no longer wait until next quarter. This is the list we are going through with our e-commerce clients:
- Take inventory of everything you have online. The store, but also the old blog, the support site, the landing page from a 2023 campaign, the test environment someone left open. That's exactly what the agents look for.
- Take admin panels out of public view. Access to the store's admin, the database manager or the hosting panel should be restricted by IP, behind a VPN or, at the very least, protected with two-factor authentication.
- Update the platform and plugins. WooCommerce, PrestaShop, Magento and their extensions. An unpatched plugin is exactly the kind of flaw an agent finds in hours.
- Ask your vendors. If an agency or a freelancer maintains any of your websites, ask in writing who updates it, how often and who has access.
- Watch for changes to files on the server. A new file that nobody uploaded is usually the back door the attacker left behind.
- Check that your backups can be restored. It isn't enough for them to exist. Try recovering one.
And if your store is on Shopify
On a hosted platform like Shopify, the server and its patches are the platform's responsibility, so a good part of this attack surface doesn't depend on you. That doesn't let you off completely: the apps you install, staff accounts without two-factor authentication and the satellite websites you built outside Shopify are still yours.
That's why, when a client asks us to choose between their own store and a hosted platform, maintenance goes into the calculation. We explain it in more detail in when to build custom and when to buy, and in what we wrote about AI agents that shop in your store: agents are already visiting your website, some to buy and others to break in.
If you want us to look at it with you
We build and maintain online stores and custom software, and when we act as a fractional CTO, the security of what's published is one of the first things we review.
Book a thirty-minute call. We go through what your company has exposed to the internet, what hasn't been updated and what depends on third parties. You leave with a list of changes ordered by risk. No commitment.
Sources
This article draws on the following publications, consulted on 21 October 2026:
Frequently asked questions
On 19 October 2026, Reuters reported that a Chinese-speaking attacker used AI agents to try to break into more than 1,200 websites, mostly online stores in the United States, Canada, Australia and Japan, and succeeded with the sites of more than 100 companies, including Deere, SharkNinja and Cummins. It was detected by researcher Snorre Fagerland of NorForge.
According to the investigation, the campaign used about 5,000 dollars in AI tokens, which works out at roughly 50 dollars for each website it got into. Each successful intrusion took a little under 23 hours on average, with the agents working autonomously.
They used Cairn, an open-source platform for coordinating AI agents, together with Claude Code and DeepSeek models.
Yes. When attacking a website costs about 50 dollars and almost no hours of human work, it pays the attacker to try thousands of sites at once and keep the ones with a flaw. The size of the company matters less than having something out of date or an exposed admin panel.
Take inventory of every website and subdomain your company has, including old and test ones; restrict access to admin panels by IP or with two-factor authentication; update the platform and plugins; and ask the vendors who maintain any of your websites who is responsible for updates.
Partly. On a hosted platform like Shopify, the server and its patches are managed by the platform. You are still responsible for the apps you install, your team's accounts, which should have two-factor authentication, and any website you have outside Shopify.