One Chinese Hacker Could Bring 100 Companies Down in an Instant
Jakarta, CNBC Indonesia — Cyber threat trends are entering an increasingly worrying new era. Hackers are reportedly beginning to use autonomous artificial intelligence (AI) to carry out mass attacks on hundreds of websites belonging to major global companies.
Reuters reported that a Mandarin-speaking hacker suspected of being from China was found deploying AI agents to breach the security systems of more than 100 prominent company websites. Those targeted included leading heavy equipment manufacturer Deere and popular household appliance maker SharkNinja.
The attacks exploited Carin, an open-source, AI-powered problem-solving platform. Although designed to resolve technical issues, the platform is now reportedly being widely misused by hackers.
Snorre Fagerland, a cyber threat researcher at NorForge, uncovered evidence of the activity while monitoring a Carin system that had inadvertently been left publicly accessible. Of the many users, the Mandarin-speaking hacker was recorded as the most aggressive.
The attacks targeted various businesses in the United States, Canada and Australia, as well as a Japanese e-commerce platform, Reuters reported, as cited by Yahoo News on Friday (30 October 2026).
The hacker did not need to type complex technical commands. With brief instructions in Mandarin of fewer than 100 characters, the fleet of AI agents was able to attempt to breach more than 1,200 different websites by mid-October 2026.
“The strategy used was highly sophisticated, not just the work of a novice hacker (a script kiddie),” Fagerland said. In one case, an AI agent was able to examine a target’s digital footprint, locate a publicly accessible control panel, identify a security vulnerability and then execute malicious commands automatically, without human assistance.
AI start-up breaches Anthropic in 12 hours
Meanwhile, AI-related data leaks have also hit AI giant Anthropic, the developer of the Claude model. The company was breached by AI start-up Cathedral in less than 12 hours.
Ironically, Cathedral was founded by former members of the US Department of Government Efficiency (DOGE). The company used autonomous AI agents to exploit a vulnerability in third-party software integrated with Anthropic’s systems, as part of a bug bounty programme.
The operation enabled Cathedral’s AI agents to access sensitive company data, including internal meeting transcripts, employee salary information and messages on Slack. Anthropic’s source code and the core model weights were nevertheless confirmed to have remained secure.
Anthropic confirmed the incident and said it cut off Cathedral’s access on the same day, after its internal monitoring systems detected suspicious activity. However, Anthropic accused Cathedral of breaching the bug bounty programme’s rules by failing to disclose the full scope of its hacking activity.
The incident comes at an inopportune time, as Anthropic is preparing for an initial public offering (IPO), with an estimated valuation of US$1.4 billion (around Rp25 trillion). The leak of internal data, even when carried out by white-hat researchers, is a warning sign for prospective investors.
Cybersecurity experts say the incidents are a stark warning for the global technology industry. Reliance on third-party software vendors has become its most vulnerable “weakest link”, open to exploitation by autonomous AI-driven attacks, however strong a company’s internal defences may be.