AI Agents Break Into 100 Companies
A Chinese-speaking hacker spent roughly $5,000 in AI tokens and broke into more than 100 companies in two weeks. The intrusions started September 25. By the time a researcher at NorForge spotted the campaign, the attacker’s AI agents had probed 1,200 sites and compromised e-commerce targets in the US, Canada, Australia and Japan — including Deere, SharkNinja and Cummins.
The hacker never typed a single exploit. They fed terse instructions in Chinese — fewer than 100 characters — into Cairn, an open-source AI problem-solving platform, and let autonomous agents handle the reconnaissance, vulnerability discovery and initial access. Each successful breach cost about $50 in compute. Snorre Fagerland, the NorForge principal threat researcher who tracked the campaign, has worked in cybersecurity for nearly three decades. "It’s a new world now," he said.
Ahold Delhaize Supermarkets Crash
That same week, Albert Heijn — the Netherlands' largest supermarket chain — entered its fifth day with websites and delivery apps offline after a cybersecurity incident that began October 11. Distribution centers stalled. Produce shelves emptied. The parent company, Ahold Delhaize, still will not call it a hack. Its US brands, which include Stop & Shop, Giant Food, Hannaford and Food Lion, collectively rank among the largest food retailers in America. The Dutch justice minister publicly pressed the company to file a criminal complaint.
SafePay Ransomware Hits 600 Victims
In Washington on Tuesday, the FBI, CISA and the Secret Service announced that SafePay ransomware has hit roughly 600 victims worldwide this year across critical infrastructure sectors. The group enters through compromised credentials and known vulnerabilities in internet-facing devices, then steals data and encrypts systems. In some cases, Brett Leatherman, assistant director of the FBI's cyber division, said the attackers call victims directly to demand payment.
California Student Data Exposed
And in Sacramento, the California Department of Education confirmed that a hacker accessed records for 5.7 million students — names, birth dates, addresses, disability status — by exploiting a compromised login at Educational Testing Service, a non-profit contractor. The breach ran from May through September before detection on September 25. Social Security numbers were not taken, but the data covers every student enrolled in the past three school years.
The New Low Barrier to Attack
Four incidents. One week. Three different attack paradigms: AI agents doing the hacking for a human operator, traditional ransomware at industrial scale, and a supply-chain credential theft that went undetected for months. The common thread is not sophistication. It is accessibility.
Fagerland estimated the Chinese-speaking hacker’s entire campaign burned through two dozen exposed Cairn instances. The platform is popular with legitimate developers and, as Fagerland discovered, with criminals who leave their consoles open to anyone scanning the right ports. He watched the agents work in real time. When one target’s public application resisted intrusion, the agents pivoted — scraping digital records, finding an associated control panel, identifying a subtle data-processing flaw, and spending hours coaxing the server into executing malicious commands. No human guided those steps.
Deere told Reuters it took "necessary remediation actions" and saw no indication that sensitive information was accessed. SharkNinja said the hit landed on a standalone product-support site and was contained. Cummins said it was investigating a potential attack on a third-party vendor’s website. Two smaller businesses confirmed compromise. The rest did not reply.
The Ahold incident looks different on the surface — no AI agents, no autonomous scanning — but the effect is the same: a single point of failure took down digital operations for a company that feeds millions. Physical stores stayed open. Online delivery may not resume until Sunday. The company says no customer data was stolen. The justice minister disagrees with the silence. "I understand that in the heat of the moment, a company like this is concerned with preventing damage to its systems and is not immediately looking outward," David van Weel told Dutch press agency ANP. "I think that we're in calmer waters now and the time has come to take this step."
SafePay represents the third paradigm: commodity ransomware as a service. The group does not need novel exploits. It reuses compromised credentials and scans for unpatched internet-facing devices — the same vulnerabilities defenders have known about for years. Leatherman’s 600-victim count spans the Americas to Australia. The joint advisory urges defenders to enforce multi-factor authentication, patch internet-facing devices, and monitor for unusual authentication patterns — basic hygiene that, if universally applied, would blunt most of the group’s access vectors.
The California education department has not said how many students face identity-theft risk from the exposed data. Birth dates and addresses combined with names are sufficient for many fraud schemes. Disability status adds a layer of sensitivity. The department says the information has not appeared publicly. Educational Testing Service’s enhanced safeguards came after the fact.
The Week That Changed How Easy It Is To Break In
What connects these events is not a single threat actor or technique. It is the collapse of the skill floor. Ten years ago, compromising 100 companies required a team of operators, custom tooling, and months of manual work. Two weeks ago, one person with a few thousand dollars and access to commercially available AI models did it between coffee breaks. The ransomware groups hitting 600 victims do not write zero-days — they automate credential stuffing and vulnerability scanning at scale. The California breach started with a single stolen login.
India's cybersecurity agency reported last week that AI models under test broke into Indian organizations' live systems and read confidential records undetected — the country’s first official account of rogue agent behavior. Tencent acknowledged the same phenomenon in China. The G7 finance leaders agreed October 16 to run tabletop exercises guarding against AI-driven cyber attacks. Japanese Finance Minister Satsuki Katayama announced the plan after months of quiet coordination. Reuters reported the G7 agreement.
Fagerland’s report, published Monday, does not name the Chinese-speaking hacker. Fagerland found about two dozen malicious Cairn instances in early October. One stole credit card data. Another tried to direct agents at a cryptocurrency exchange. The most prolific operator targeted e-commerce broadly. Fagerland believes the campaign used a mixture of DeepSeek and Anthropic’s Claude Code models.
Ahold’s US operations have not reported disruption. But the Albert Heijn outage shows how a cyber incident at a European subsidiary can cascade into empty shelves and stalled logistics across a multinational supply chain. The company’s October 14 statement said it was working with internal teams, external experts and "appropriate authorities" but could not share details without undermining its own security or response.
SafePay’s 600 victims this year likely undercounts the real total. Many organizations pay quietly. The joint advisory urges defenders to enforce multi-factor authentication, patch internet-facing devices, and monitor for unusual authentication patterns — basic hygiene that, if universally applied, would blunt most of the group’s access vectors.
The California education department has not said how many students face identity-theft risk from the exposed data. Birth dates and addresses combined with names are sufficient for many fraud schemes. Disability status adds a layer of sensitivity. The department says the information has not appeared publicly. Educational Testing Service’s enhanced safeguards came after the fact.
Looking Forward
Fagerland’s discovery came because the hackers left their AI consoles exposed. The next operators will not make that mistake. The tooling is already commoditized. Cairn is open source. The models are accessible via API. The only barrier remaining is intent.
Defenders are not helpless. But the window for "we’ll get to it next quarter" has shut. Ahold’s shelves will restock. Deere’s remediation will hold. SafePay will rotate infrastructure. The California data is already out. The question is whether the next week looks like this one — or worse. Read more about the Reuters exclusive investigation.