Infiltrating More Than 100 Sites With AI Agents: The Cost of Attack Has Collapsed

Cyberattacks carried out with AI agents are moving from theoretical threat to reality. According to findings from security firm Norforge, a single attacker used a largely autonomous swarm of agents to breach more than 100 websites. Reuters reported that the victims include companies such as John Deere, SharkNinja and Cummins.

What happened?

Norforge did not name the targets; the company names come from Reuters' reporting. The attacker ran many AI agents at the same time, keeping human involvement to a minimum. The agents scanned sites, looked for weak points and carried out intrusion attempts on their own. The technical details of the attack and the extent of the damage remain unclear for now.

Why does it matter?

The classic economics of cyberattacks were built on labor. Reconnaissance, vulnerability scanning, adapting exploit code and moving around after a breach each required separate expertise. Attackers therefore treated time and manpower as scarce resources and chose only high-return targets. A mid-sized industrial company or a small consumer brand often fell outside that calculation. That was also the implicit assumption of many security teams: "Nobody will specifically target us."

Agent swarms upend that calculation. One person can run reconnaissance on hundreds of targets in parallel; if an agent gets stuck at one door, it moves on to the next. This differs from the familiar logic of automated scanning tools. Older scanners only looked for known signatures. Agents built on language models, by contrast, can read the structure of a page and try a new route depending on the situation. When costs fall, "low-return" targets become profitable too.

This development is not a surprise. Anthropic has previously published reports on the misuse of Claude, describing how criminals used models to write code and run operations. Other major labs have shared similar misuse reports. In those reports, AI was mostly an assistant that sped up the attacker. The incident Norforge describes shifts the weight from assistant to operator: the human sets the strategy, and the agents do the work. Still, the evidence rests on the statement of a single security firm; until the details are independently verified, the scale should not be overstated.

Does defense have to become agentic too?

Once the speed of an attack exceeds human reaction time, the model of an analyst watching an alert queue falls short. The logical conclusion is that defense must lean on automation as well: continuous vulnerability scanning, automatic isolation on anomalous behavior, model support in patch prioritization. It is no coincidence that security vendors are moving toward agent-based products.

Microsoft announcing tools the same day that restrict agents' permissions points to a second front. The problem is not only malicious agents; agents that companies run internally also create an attack surface when left with broad privileges. Every system an agent can reach is a system an attacker can reach once the agent is compromised. Narrowing permissions, logging actions and requiring approval steps are now basic conditions for deploying agents.

Who is affected, and how?

The takeaway is the same for companies in Türkiye. In a cross-border attack, language and geography are trivial obstacles for agents; a model can read a Turkish interface as easily as an English one. Ordinary shortcomings such as outdated web applications, exposed admin panels and reused passwords are already the first places automated agents look.

What's next?

Three things are worth watching. First, whether Norforge or independent researchers publish technical details; which vulnerabilities enabled the intrusions will be decisive. Second, how early model providers can catch autonomous attack patterns; individual commands may look innocent while the overall behavior is an attack. Third, whom regulators will hold responsible for the use of agents.

My assessment: AI did not invent attacks from scratch, but it lowered the cost of scaling them. That makes the distinction of "important target" meaningless in defense. Basic hygiene, meaning patching, multi-factor authentication and narrow permissions, becomes more valuable than anything spectacular, because an agent swarm finds the easiest door first.