The story so far
The working headline is the story: AI agents breach 100 websites. Fresh reporting says a Chinese-speaking hacker used autonomous AI agents to infiltrate websites associated with Deere, SharkNinja, Cummins and nearly 100 other companies, turning what had sounded like a laboratory warning into an operational cybercrime pattern . The attacker reportedly relied on Cairn, an open-source AI problem-solving and agent orchestration platform, to coordinate agents that could probe targets, reason through weaknesses and attempt exploitation with minimal human supervision .
Security Boulevard, citing NorForge researcher Snorre Fagerland and Reuters reporting, says the intrusions were notable not because the vulnerabilities were magical or unprecedented, but because the workflow was automated enough to change the economics of attack . In the reported campaign, the AI agents used a mix of Claude Code and DeepSeek, received brief instructions about intrusion tactics, and were able to reach successful compromises in about 23 hours at an estimated average cost of about $50 in tokens per successful hack . That is the core shift: a task that once required sustained human reconnaissance, tool selection, debugging and patience can increasingly be compressed into a cheap, repeatable agent loop.
The immediate joke is obvious — Skynet apparently discovered the web stack before the time machine — but the operational lesson is less funny. The case suggests that exposed panels, neglected web applications, weak patch discipline and forgotten internet-facing assets are no longer waiting for one tired human attacker to notice them. They can be processed, revisited and chained together by tools that do not sleep, do not lose focus and do not care whether the first 20 attempts fail.
Why this is not just “AI-assisted hacking”
The distinction between AI-assisted and agentic intrusion matters. Traditional AI misuse might mean writing a phishing email, generating code snippets or summarizing documentation. Here, the reported significance is that agents were used to conduct reconnaissance and exploitation steps as a continuing workflow, with the human operator steering goals rather than manually performing every move . Cairn treats each task as a project with an origin and a goal, and its agent framework moves through steps in a state-based process .
That does not make the agents omnipotent. Security experts quoted in the current reporting emphasize that the campaign did not necessarily invent a new class of vulnerability . The more important point is scale. Aviv Nahum of Above Security framed the change as one of volume and economics: one person can automate work that previously took significant time, expertise and manpower . John Gallagher of Viakoo put the defensive implication more starkly: periodic patch cycles and manual remediation are poorly matched to adversaries that can probe attack surfaces around the clock .
The Washington Post’s broader cyber reporting makes the same point from another angle. It describes a wider wave of AI-enabled hacking in which both experienced operators and amateurs are getting help from AI tools, and quotes CrowdStrike’s Adam Meyers saying that “any pedestrian, non-hacker” can now begin using these frameworks against targets . The Post also reports that cybersecurity leaders expect malicious hackers to benefit more in the short term, even though the same technology can eventually help defenders find and fix bugs faster .
The LodaRAT campaign: old malware, industrial-scale lure
The second current development around the same defensive problem is not an autonomous-agent breach, but it belongs in the same risk picture. Cybersecurity Insiders reports that a phishing campaign impersonating the United States District Court for the Southern District of Florida is targeting more than 100,000 companies with fraudulent Alternative Dispute Resolution notices designed to distribute LodaRAT . The lure works because it borrows the urgency and authority of legal process: recipients receive personalized messages with unique ADR identifiers, then are pushed toward a fake court portal at florida[.]courtadr[.]com .
According to the report, the fake portal displays company-specific information and prompts visitors to download supposed legal documents through a password-protected ZIP archive . Inside that archive is an ISO disk image containing three malicious files — Court_Order_for_ADR.msc, Original_Complaint.bat and Supporting-lawsuit-documents.lnk — each using a different execution method to download and launch LodaRAT under names that resemble legitimate Windows executables, including SystemSettings.exe, Taskmgr.exe and msedge.exe .
LodaRAT is not new glamour malware, but the campaign’s presentation is the point. Cybersecurity Insiders reports that the malware can steal credentials from major browsers, log keystrokes, capture screens, access webcam and microphone streams, provide remote control, support RDP tunneling and reverse SOCKS proxy connections, and help lateral movement across compromised networks . Researchers also identified persistence through Registry Run keys, Startup shortcuts, scheduled tasks and watchdog scripts, with all three variants communicating with the same command-and-control server at my[.]thispc[.]net:4000 .
The common thread: defenders are being paced
At first glance, these are different attack lanes. One uses autonomous agents to scale technical exploitation against websites. The other uses a convincing legal pretext to scale social engineering against corporate inboxes. The shared message is that defenders are being paced by systems that reduce friction for attackers.
In the agentic breach case, the friction reduced is technical. A single operator can issue short instructions and let agents grind through discovery, testing and exploitation attempts . In the fake court campaign, the friction reduced is psychological and organizational. A legal-looking notice creates a reason for an employee to hurry, click, download and rationalize the odd file format because the message appears to involve a court process .
Both cases also punish fragmented ownership. Website teams may not own email security. Legal teams may not recognize malware delivery mechanics. Security operations teams may not have a live inventory of forgotten web assets. IT teams may block executables but still allow password-protected archives, ISO images, scripts and shortcuts to reach endpoints. Attackers benefit when those seams are wider than the organization’s response loop.
What security teams should change now
The first change is to monitor behavior, not just identities. If AI agents can probe thousands of endpoints without fatigue, defenders need detections for unusual sequencing: repeated endpoint discovery, odd upload attempts, control-panel access from unexpected infrastructure, rapid testing of old web paths, and machine-like retries across a broad attack surface . Signature-based blocking still matters, but it is less useful when the attacker’s strength is recombining known weaknesses faster than humans can triage them.
The second change is to make remediation continuous. Security Boulevard’s current reporting emphasizes continuous attack-surface monitoring, automated patching, credential rotation, behavioral threat detection and rapid remediation as priorities against persistent AI-driven attackers . Those are not fashionable dashboard terms; they are the minimum counterweight to tools that can run 24/7.
The third change is to harden the inbox-to-endpoint chain. For the LodaRAT campaign, companies should route unexpected court or regulator notices to legal and security review, verify them through independently obtained court contacts, and avoid using links or phone numbers supplied in the message itself. Email and endpoint controls should be reviewed for password-protected archives, ISO files,.msc consoles, batch files, shortcuts and lookalike executable names, because the campaign’s chain depends on those handoffs .
Finally, drills need to reflect the lures employees actually see. A generic “don’t click phishing links” lesson is too weak for a message that names the company, carries a case-style identifier and presents a polished fake portal. The test should teach staff that personalized detail is not proof of legitimacy, and that urgency from a supposed authority is exactly when verification should slow the process down.
The bottom line
The latest reporting does not prove that AI agents have made defenders helpless. It proves something more practical: attackers can now buy speed, persistence and acceptable competence at very low cost. The websites allegedly breached by AI agents and the 100,000-plus companies targeted by fake ADR notices are reminders of the same new baseline. Security programs must be built for adversaries that automate the boring work, exploit stale exposure quickly and wrap old malware in high-pressure narratives. The summons now comes with malware, because even villains bundle unwanted DLC.
Comments
Be the first to comment.