EXCLUSIVE: How one hacker used AI agents and a few thousand dollars to break into scores of sites