AI Agents Linked to Over 100 Website Breaches

A newly published investigation links AI agents to a campaign that compromised more than 100 company websites, showing how one operator can delegate prolonged intrusion attempts to automated systems.

Reuters identified affected sites associated with Deere, SharkNinja and Cummins after reviewing activity described by cybersecurity researcher NorForge. The agency could not establish the extent of unauthorized data extraction. Deere reported no indication of sensitive-data access; SharkNinja described a contained incident at a support site; Cummins said it was investigating a possible incident involving a vendor’s website.

What the underlying research establishes

NorForge’s report, published October 19, describes more than 20 exposed control panels assessed as likely connected to malicious activity. These gave researchers a view of operators setting objectives and agents pursuing them. The report also found exposed panels associated with apparently legitimate security testing, a separate confidentiality risk for those clients.

One Chinese-language cluster accounted for more than 1,100 attack projects across 14 dashboards in NorForge’s account. The researcher assessed the observed activity as financially motivated and did not identify obvious state-sponsored operations. Language alone does not establish an operator’s nationality or government affiliation.

The observation is important because it concerns operational behavior rather than a controlled benchmark. It also has limits: exposed dashboards are a sample of visible activity, not a census of every malicious use of AI. Project counts cannot simply be treated as counts of distinct victims or successful thefts.

The financial exposure extends beyond stolen records

For a business, unauthorized access can create costs even when a sensitive-data loss has not been established. Investigation, restoring trusted systems and checking third-party connections all require time and specialist work. Any estimate of actual losses would need evidence from the affected organization; this investigation does not provide a company-by-company financial total.

A supplier-operated site introduces another boundary. The owner of a corporate brand, the operator of a website and the organization responsible for its infrastructure may be different parties. That makes incident scope and contractual responsibilities essential to interpreting an announcement.

Containing an incident requires an account-level investigation

The first distinction for a website operator is between a request that was rejected, access to a nonpublic interface and a confirmed transfer of sensitive data. Those are different incident outcomes. A count of targeted websites cannot establish how many suffered each outcome, and a demonstration of access cannot establish the full contents of a database. Reporting should retain those limits even when an attack uses a fashionable new tool.

For a business, the practical exposure depends on the permissions attached to the account or service involved. A system that can read public information presents a different problem from one authorized to export customer records, change payment details or create new administrators. Reviewing those permissions and retaining usable access logs helps establish the possible scope without assuming every connected system was compromised.

Containment also has a commercial cost. Restricting a connection can interrupt legitimate work; leaving it available can prolong exposure. The decision requires evidence from the affected environment, rather than a universal instruction to shut down every automated service. Customers need clear information about the functions affected and any action they actually need to take.

The financial significance would become clearer with verified information about data exposure, downtime and remediation spending. None of those amounts can be inferred by multiplying the number of named websites by an assumed loss per breach.

A separate case from earlier AI warnings

TTN recently covered a warning from India’s cyber agency. The NorForge investigation is a separate source of evidence and should not be merged with that earlier report into a larger unsupported victim count.

For companies adopting agents internally, the same question of permissions remains central. The reporting on enterprise AI and data access examines the boundary between useful automation and excessive authority. Meanwhile, website restrictions on agents concern service access and consent, which are different from authorization to test or enter a system.