Autonomous AI agents used to breach more than 100 company websites

A Chinese-speaking criminal operator pointed autonomous AI agents at company websites and let them break in with almost no human involvement, according to a report published on 20 October 2026 by The Hacker News. The agents attempted attacks on more than 1,200 sites and successfully reached websites belonging to more than 100 companies, including the farm-equipment maker Deere and an appliance company.

The campaign came to light because the operators left their control panels open on the internet, the report said. A security researcher was able to watch the attacks as they happened. That is unusual: most intrusion campaigns are reconstructed afterwards from logs and forensic evidence, rather than observed live through the attacker's own dashboard.

The detail that matters for defenders is the degree of automation. According to the report, the agents did the breaking in themselves, with almost no help from the human operator. In a conventional intrusion, a person picks targets, runs tools, reads the output and decides what to try next. Here, that loop appears to have been handed to software. The operator's role was closer to supervision than to hands-on hacking.

That changes the economics of attack volume. Trying 1,200 websites by hand is slow work. Trying 1,200 websites with agents that can probe, interpret results and adapt without waiting for instructions is a different proposition. The reported hit rate — more than 100 companies reached out of more than 1,200 attempted — suggests the agents were not succeeding everywhere, but they did not need to. Breadth compensated for precision.

The root cause here is not a flaw in an AI product. It is tool misuse: general-purpose agent capabilities turned towards offensive work. The sources do not identify which AI models or agent frameworks were used, and no vendor has been named as the supplier of the technology. Nor do the sources say how the agents gained access to the sites they reached, what data was taken, or whether the affected companies have been notified.

Deere is the only named victim in the available reporting, alongside an unnamed appliance manufacturer. Neither company's response is recorded in the source. The status of the incident is reported rather than resolved, and there is no public statement from any of the organisations involved.

Security teams have spent the past two years discussing the theoretical risk of agentic attack tooling — software that can chain together reconnaissance, exploitation and follow-on actions without a person in the loop at each step. This report describes that pattern in use against real commercial targets at scale.

One practical observation follows from how the campaign was discovered. The attackers ran their own exposed infrastructure, with control panels reachable from the open internet and no apparent access controls on them. The same operational carelessness that defenders are routinely warned about applied to the people running the attacks. That is what gave a researcher a window into the operation, and it is the reason the campaign is public at all.

Further detail on the targeting, the agent tooling and the companies affected has not yet been published. Organisations that run public-facing websites may wish to review their logs for high-volume automated probing, though the sources do not describe specific indicators of compromise.