One hacker let AI agents break into more than 100 company websites for about $50 each, Reuters reports. Last week, JPMorgan and Schwab told their customers' AI agents to stay out.

The Short Version

Starting September 25, a Chinese-speaking hacker gave an open-source tool called Cairn a short instruction, fewer than 100 Chinese characters, and let AI agents do the rest. By late last week those agents had tried more than 1,200 websites and broken into more than 100 companies, including Deere, SharkNinja and Cummins, Reuters reported this morning. A security researcher puts the cost of the whole run at about $5,000 in AI usage, roughly $50 for each successful break-in.

Set that beside what two of the country's biggest money firms said on their earnings calls last week. JPMorgan Chase won't let an outside AI agent log in with a customer's password. Schwab won't either, and it's steering clients to its own assistant. Both cite safety. Critics say Schwab also has cash to protect.

My read is that these are one story seen from two sides. A login was built to prove a person is present. Agents now press on logins from both directions, as burglars and as helpers, and companies are deciding which ones get through. If you run a website or let an AI assistant near your money, those decisions now land on you.

How a $5,000 Campaign Reached Deere

Snorre Fagerland, a threat researcher at the security firm NorForge, found the campaign the way you'd notice a light left on. He was scanning the internet for exposed copies of Cairn, a free AI problem-solving platform popular with hackers. Starting around October 2, he found about two dozen copies being used for attacks. His report named no victims, so Reuters identified them by reviewing the hacker's own Cairn activity.

The targets were online stores in the United States, Canada, Australia and Japan. A successful intrusion took about 23 hours of the agents probing on their own. In one case, the agents found a related server, located a control panel open to the public internet, spotted a subtle flaw in how it processed data, and got the machine to run the attacker's commands. "It's not script kiddie stuff," Fagerland told Reuters, using the hacker term for amateurs who run other people's tools.

The companies Reuters named describe limited damage. Deere said it took "necessary remediation actions" and saw no sign that sensitive information was accessed. SharkNinja said the attacker reached a standalone product-support site and the threat was contained. Cummins said it was investigating a possible attack on a website run by one of its vendors. Reuters couldn't determine how much data left any of them.

Fagerland estimates the agents ran on a mix of DeepSeek's models and Anthropic's Claude Code. The report carries no comment from either company. Cairn's pseudonymous author posted on X that the tool "was not designed for hacking attacks" and that harmful use was never the intent.

A claim this large deserves a second look, and the pattern has one. In September, the Israeli firm Gambit Security described a different operator who used Cairn and two other free agent tools to breach at least 27 companies and steal more than 600,000 credit card records. Gambit put the average cost of a completed scan at about $25, and its threat intelligence director wrote that where access was achieved, it usually took less than a day. The Next Web, which reported Gambit's findings, said it hadn't verified them independently.

Fifty Dollars Changes Who Gets Picked

I think of break-ins as rationed by skill and time. A capable human attacker has to pick targets worth the effort, and that has spared a lot of small sites. At roughly $50 per success, the math flips. An agent can work the same 23 hours on a farm equipment giant's support page or a kitchen-gadget shop's checkout, and the bill comes out about the same.

Look at which doors opened. SharkNinja's breach hit a separate support site, and Cummins points to a vendor's site. Those are the side buildings of a company's online presence: the promo page from 2021, the warranty portal a contractor built, the admin panel nobody remembers is public. Agents that keep probing for a full day are good at finding them.

Fagerland told Reuters he had assumed hacker agents would still need some human supervision, and the campaign changed his mind. Reuters says other operators he watched used agents to steal a large set of credit card data and to try to rob a cryptocurrency exchange. The threat intelligence firm Bitsight says talk of autonomous agents is surging on criminal forums.

Banks Close the Side Door

On the other side of the login, the people being turned away are customers.

On Tuesday, Oct. 13, JPMorgan Chase CEO Jamie Dimon told analysts the bank won't let just any outside agent inside. "You don't want rogue agents, and it could be thousands of them," he said. A bank spokeswoman told CNBC that JPMorgan bars third parties from logging into accounts with a customer's banking credentials, Cybernews reported. Outside agents can see some account data in read-only form, and they can't send money or pay bills.

Two days later, Schwab CEO Rick Wurster went further on his own call. "There's one way we think is not safe, and that's just an agent coming to our site and trying to log in," he said, according to American Banker. Schwab points clients to Charley, its in-house assistant, which for now handles a few chores like changing an address or naming a trusted contact. The company plans to let Charley place trades but keep it from moving money. Wurster said blocks are rare so far because most clients don't use AI that way.

The security case is the Reuters story in miniature. An agent holding your password looks to the bank exactly like you, and if thousands of them misbehave, the bank can't separate a helper from a thief at the door. Amazon blocks unauthorized shopping agents under its conditions of use. Meta went the other way with Muse, the assistant it launched in September that can browse, fill out forms and make purchases.

The money case is harder to wave off. Schwab reported about $3.5 billion in net interest revenue last quarter, much of it earned on roughly $493 billion in cash sweep accounts, and an independent agent might move that idle cash somewhere that pays more. "An outside agent works for the client. Charley works for Schwab," Tim Welsh, founder of Nexus Strategies, told American Banker. AI Next Wave covered this tension on Sept. 30, when Robinhood announced trading agents and Apollo's Torsten Slok warned that agents could sweep household cash out of banks. Both readings can hold at once. I'd judge each bank by whether it gives customers a safe, sanctioned way to let an outside agent help, or only its own agent.

One Shop Owner's Next Two Weeks

Picture Luis, who runs a nine-person online cookware store. His main shop sits on a hosted platform. A contractor built a warranty-registration site for him in 2022 that still runs on its own server, and there's an old wholesale portal he rarely thinks about.

His first move after reading the Reuters story costs nothing: a list. Every web address the business owns or pays for, who built it, who can log in, and when it was last updated. That list is his baseline, along with what he can already see, such as how many failed logins each site recorded last month.

Then a bounded pilot. He hires the contractor or a security firm to test only the two oldest sites over two weeks, with written permission and a fixed fee. A result counts only when it's closed: a flaw patched or a site shut down, logged with a date. The added work is real. Someone on his small team spends a few hours confirming each fix, and the warranty site may go dark for a day. It can fail in familiar ways. The scope may be too narrow to catch anything, or the problems may sit inside the hosted platform, which means a support ticket and a wait. Luis keeps the authority to stop the test if it disrupts orders, and the tester needs his sign-off before touching anything live. If the old warranty site costs more to fix than it's worth, the cheapest security upgrade is switching it off.

The pilot answers one narrow question: whether the side buildings of his business are open. That's exactly where the companies in the Reuters story got hit.

Opportunity Radar

Small online sellers now face attackers whose cost per target is falling fast, and the Reuters victims were hit through side sites like support pages and vendor portals. The pitch: a flat-fee inventory of forgotten sites for shops with fewer than 50 employees. You'd find every domain, subdomain and admin page tied to the business, flag the old or exposed ones, and hand over a one-page list with a call for each: patch it, hand it to the platform, or shut it down. The owners might pay, and so might the agencies and payment processors that serve them and want fewer breached clients. Test it cheaply by offering ten free inventories and counting how many owners find a site they'd forgotten and how many would pay for a quarterly recheck. Treat demand as a guess until those numbers come back. Walk away if owners leave the list unread or if hosting platforms start doing it for free.

What You Can Do With This

If you run an online store or a small business site

List every site and login page you pay for, including the ones a contractor built years ago. Shut down anything idle. Ask any vendor running a site in your name when it was last patched and who gets alerted when something goes wrong.

If you use an AI assistant with your accounts

Keep your bank password away from it. JPMorgan and Schwab now block that route because anything holding your password can act as you. Use your bank's own tools or read-only connections, and read the bank's terms before linking anything new.

If you handle IT or security for a larger company

Assume automated attackers will reach your vendor-run and legacy sites first. Pull third-party web properties into your scanning and incident plans, and ask vendors to report on them the way your own teams do.

If you're choosing a bank or brokerage

Ask whether it offers a sanctioned way for outside tools to read your data, and what it pays on the cash that sits in your account. A firm that blocks every outside agent is also deciding who gets to manage that cash.

The Bigger Picture

The login screen is becoming the place where the agent economy gets sorted. Criminal agents hammer on it for about $50 a success. Customer agents get turned away from it by banks that say they can't tell the two apart. Both pressures point to the same missing piece: a way for an agent to prove whose behalf it's acting on and what it's allowed to do, separate from the human's password. Until something like that is widely used, companies keep choosing between two blunt options: open the door and hope, or close it and keep customers inside their own assistant. My guess is that more banks and retailers follow JPMorgan, Schwab and Amazon in the coming months, and that attackers keep aiming at the sites nobody remembered to count. The businesses that know exactly what they have online will be the cheapest ones to defend.

References

Reuters (Raphael Satter), via 93.3 The Drive: Exclusive: How one hacker used AI agents and a few thousand dollars to break into scores of sites, Oct. 19, 2026 Reuters (Raphael Satter), via 102.7 WBOW: same report, Oct. 19, 2026 The Next Web: AI agents stole 600,000 credit cards for about $25 a target, Gambit says, Sept. 28, 2026 Cybernews: JPMorgan blocks outside AI agents from customer accounts, Oct. 14, 2026 (updated Oct. 16) American Banker: Schwab blocks unauthorized AI agents, points clients to Charley, Oct. 15, 2026 (updated Oct. 16)

Read on the web: https://theainextwave.com/editions/2026-10-19/