A hacker's AI agents hit 100+ firms, Otter's $320M, and image AI on a budget

A Reuters investigation published on October 19 describes one of the clearest real-world cases yet of AI agents doing most of the work in a hacking campaign. According to Reuters and research from the security firm NorForge, a Chinese-speaking operator used AI agents to attempt break-ins at more than 1,200 websites, mostly online stores in the United States, Canada, Australia and Japan. The agents got into websites belonging to more than 100 companies. The campaign began on September 25. Reuters named Deere, SharkNinja and Cummins among the companies whose sites were targeted, with very different levels of impact.

NorForge principal threat researcher Snorre Fagerland found the operation almost by accident, while scanning the internet for exposed installations of Cairn, an open-source platform that coordinates AI agents on general problem-solving tasks. The attackers had left their own dashboards open. The operator gave the agents a target and a goal. The agents searched for weaknesses, posted what they found on a shared project board, and switched approach when one path failed. A separate step used Microsoft's Playwright browser tool to check that each shop actually accepted orders. Tasks focused on flaws that allow code to run without a login, such as SQL injection and unsafe file uploads.

NorForge tracked the largest cluster, which it calls AIA0001, across 14 dashboards and more than 1,100 attack projects. Successful projects took just under 23 hours on average, and one ran for more than five days. NorForge estimates a success rate of about 10%. Fagerland estimated roughly $5,000 in AI token costs for the main campaign, about $50 per successful intrusion, or close to $5 per task once failed attempts are included. In one confirmed case NorForge found a live web shell, a hidden back door, on a hardware vendor's site. Fagerland told Reuters it was "not script kiddie stuff."

There are important caveats. The cost figures are estimates, because NorForge had no billing data. Worker names hinted at a Claude Code setup running a DeepSeek model, but that is unconfirmed, and researchers found no clear evidence of state backing. Cairn itself was not shown to contain a software flaw; the problem was installations left open on the internet. Impact also varied. Deere says it took corrective action and found no sign that sensitive data was accessed. SharkNinja says only a separate product-support site was affected and the threat was contained. Cummins is investigating a site run by a third party. Reuters could not determine how much data, if any, was taken.

The bigger lesson is that the cost of trying is collapsing. Attacks that once needed hours of a skilled person's time can now run unattended overnight for a few dollars each, which makes the long tail of small online shops on old software worth targeting. The defensive basics have not changed: patch public-facing applications, restrict admin panels, watch web folders for files nobody uploaded, and isolate any server where a web shell turns up. What has changed is speed and volume. The attackers' own tools also exposed them: NorForge found hundreds of exposed secrets in the open panels, a reminder that any AI agent platform left on the public internet is itself a target.

Why it mattersCheap, unattended AI agents make it economical to attack small businesses that were never worth a human hacker's time, so basic web security is now a real need for every online shop.

Otter.ai, the company behind the popular AI meeting note-taker, announced on October 20 that it has raised $320 million from General Catalyst's Customer Value Fund (CVF). The unusual part is the structure. CVF provides capital without taking equity, so Otter's founders and existing investors are not diluted. Instead, according to TechCrunch, the fund earns its return based on the results of the marketing spend the money pays for. Otter says it will use the funds for enterprise growth, its go-to-market strategy, international expansion and new products.

The size of the deal stands out against Otter's history. The company has been operating for nearly a decade and had raised only about $50 million in total before this, with its last round in 2021, according to PitchBook data. This single financing is therefore roughly six times everything it raised before. Otter said last year that its annual recurring revenue had passed $100 million, and it now says 40 million people have used the product, up from 25 million a year ago. The repayment terms, the share of revenue involved and the cost of the capital have not been disclosed.

Otter's product plans show where it thinks the value is moving: from writing notes to acting on them. Beyond its OtterPilot meeting assistant, launched in 2023, it offers search across work apps and enterprise connections that turn meeting data into automated workflows. It is testing a pre-brief feature that sends people background before a meeting, and Live Assist, which lets users ask the AI questions during a call. Pranav Singhvi, a partner and co-founder of CVF, called voice one of the biggest untapped opportunities in enterprise AI. Otter has also hired Alex Gay, formerly of Superhuman, as chief marketing officer.

There are reasons for caution. Otter did not share updated revenue, monthly active users or churn, and the 40 million figure counts everyone who has used the product to date, not current users. Financing tied to marketing results can cost more than equity in cash terms if growth is strong, and it only works while the payback on customer acquisition stays predictable. The market is crowded too. TechCrunch lists Fireflies.ai, Granola and Read AI as established rivals, with Calendly, Wispr and Superhuman, which acquired Fathom, among newer entrants, while video-call platforms keep adding their own AI notes.

For builders, the deal sends two signals. First, the money in meeting AI is moving from transcripts to what happens afterwards: tasks created, CRMs updated, follow-ups sent. Integration work that connects meeting data to the tools a business already uses is where many smaller players can compete. Second, non-dilutive capital tied to marketing performance is available to companies that can prove a steady return on each dollar spent acquiring customers. That makes clean unit-economics data, such as acquisition cost, payback period and retention, a fundraising asset in its own right, not just an internal report.

Why it mattersIt shows that an AI software company with predictable revenue can raise large sums without selling equity, and that meeting AI is shifting from taking notes to triggering work.

Most image generators understand prompts with help from a language model that was first trained on huge amounts of internet text. A paper posted to arXiv on October 19 by researchers from Stanford University and the AI company Radical Numerics questions whether that step is needed. The team, which includes Li Fei-Fei, Jiajun Wu and Michael Poli, built Halcyon, a family of text-to-image models trained from scratch on GPIC, a dataset of 100 million image-text pairs, with no language pretraining at all. They have published ten model checkpoints, from 0.1 billion to 4 billion parameters, on Hugging Face.

The headline results are about efficiency. The authors report that Halcyon-0.52B beats LlamaGen-XL/8 on gFD, a measure of how closely generated images match real ones where lower is better (48.0 versus 63.3), using 18.2 times less pretraining compute. Halcyon-1.6B beats JiT-T2I-XXL/8++ (35.3 versus 41.0) with 275 times less compute. On prompt-following benchmarks, the 1.6B model scores 53.48 on GenEval against 43.17 for that rival, and the 4B model reaches 56.39. In controlled tests, a bigger text encoder, language-first pretraining and starting from a small pretrained Qwen3 model all failed to improve gFD.

Technically, Halcyon is an 'early-fusion autoregressive' model: the caption and the image are turned into one sequence of tokens, and the model learns to predict the next token, much like a chatbot predicts the next word. The 4B model uses a Qwen3-style architecture with random starting weights and draws each image as a 32-by-32 grid of 1,024 tokens. The team also found a cheap bonus. By replacing the usual 'caption dropout' training examples with image-to-text examples, the same model learns to write captions for images at no extra pretraining cost, while keeping its generation quality competitive.

The caveats are significant. Images are 256 by 256 pixels, far below what commercial generators produce, so this is a research result, not a ready product. All benchmark numbers are the authors' own, measured largely on their own GPIC test set, and some margins are small: on the DPG-Bench test the 1.6B model leads by about one point (77.90 versus 76.85). The training code is marked 'coming soon', the project page and model cards do not state a licence, and it is unclear whether the GPIC dataset will be released. The compute savings are given as ratios rather than GPU hours.

If the findings hold up, they lower the bar for building specialised image models. An organisation with a good collection of captioned images, such as a fashion archive, a medical imaging group, a crop-disease project or a museum, might train a useful model of its own without first licensing or training a large language model. It also shifts attention to data: when the model learns language and images together from captions, the quality and coverage of those captions matter even more. For builders, the near-term opportunity is in data preparation, experimentation and education rather than in shipping products on these exact weights.

Why it mattersIt suggests that capable, domain-specific image generators could be trained far more cheaply, with good captioned data mattering more than access to a giant language model.