Imagine a digital criminal capable of attacking dozens of companies simultaneously, using an entire army of artificial intelligences to hunt for security flaws and attempt to breach their systems. It sounds like a movie script, but recent research has revealed that this is already happening. According to Reuters, investigators from the security firm NordForge identified a hacker who used artificial intelligence agents to compromise more than 100 websites, including systems linked to major companies such as John Deere, SharkNinja, and Cummins.

Most striking of all is that the criminal did not need to manually execute each stage of the attacks. He used an open-source tool called KIR, which is capable of coordinating AI agents that receive instructions and carry out various tasks with relative autonomy. These agents could investigate websites, identify potential vulnerabilities, and execute sequences of actions to attempt to exploit them. According to the investigation, the hacker directed these systems against more than 100 e-commerce sites across the United States, Canada, Australia, and Japan. Some of the breaches took approximately 23 hours to complete, at an estimated cost of just $50 in artificial intelligence processing power for each successful attack.

This reveals a highly concerning shift: previously, carrying out complex attacks against multiple targets required time, specialized knowledge, and a relatively large team. Now, however, tools can automate part of that work, allowing a single criminal to target a far greater number of systems—though it is important to note that not all such attempts resulted in successful breaches. John Deere reported that it implemented corrective measures and found no evidence of access to sensitive information; Shark Ninja confirmed that a website—which did not store confidential data—was accessed; and Camens stated that it is investigating a potential incident involving a third-party provider.

This does not mean that artificial intelligence systems have decided to commit crimes of their own volition. Rather, they were being used by an individual who set the targets for the attacks. The issue is that, once deployed, these tools can execute multiple stages without constant human oversight. This creates a new challenge for digital security: while companies use artificial intelligence to identify vulnerabilities and protect their systems, criminals are beginning to exploit the same technology to discover ways to breach them.

Another major question now is whether defense systems will be able to keep pace with the speed of attacks that no longer rely on a person to execute every individual command.