AI Agents Broke Into More Than 100 Company Sites for About $50 Each, a Researcher Estimates. The Operator Left the Dashboards Open.
On Monday, October 19, 2026, security firm NorForge published "Inside Cairn," a report on more than 20 internet-exposed control panels for Cairn, an open-source platform that sends AI agents after a goal step by step. The same day, Reuters put names and numbers on what those panels showed.
One Chinese-speaking operator, Reuters reported, had used AI agents to break into more than 100 companies, including Deere, SharkNinja and Cummins. The campaign started on September 25. By late last week the agents had tried more than 1,200 websites. The instructions that launched them ran to fewer than 100 Chinese characters.
The price is the number people will remember. NorForge principal threat researcher Snorre Fagerland estimated about $5,000 in tokens, or roughly $50 per successful hack. He called the figure rough. We think the more important fact is how anyone found out at all: the operator left the dashboards on the open internet.
What the Panels Showed
NorForge says it started looking after Gambit Security found Cairn on an attacker's staging server in September. Searches on Shodan and Censys turned up a handful of open Cairn panels, and later scans found new ones coming online quickly. Reuters says Fagerland found about two dozen malicious instances around October 2. NorForge sorted them into three clusters.
| Cluster | Language | Panels | What it was after | Confidence |
|---|---|---|---|---|
| AIA0001 | Chinese | 14 | Over 1,100 attack projects on shopping sites in the US, Canada, Japan and Australia; goal is code execution and an "uploader shell" | High |
| AIA0002 | English | 10 | Payment, gray-market payment and pharmacy sites; tasks include stealing credit cards and cryptocurrency | High |
| AIA0003 | English | 1 | 59 projects seeking shell, admin panel or database access | Low |
The Chinese-language cluster is the one Reuters wrote about. Its task text describes "confirmed real shopping/e-commerce websites" with traffic between 200,000 and 1.5 million. Every task ran on a worker named claudecode_deepseek-v4.1-flash. NorForge reads that as a Claude Code harness driving DeepSeek's V4.1 Flash model, but it did not confirm the setup, and Reuters says only that the campaign appeared to use both.
The pace was patient rather than fast. Successful projects in that cluster took a little under 23 hours on average from start to goal, and one ran for more than five days. NorForge puts the average success rate across the clusters at around 10 percent, with many of the rest reaching partial goals.
The cost estimates come in two shapes. NorForge's report estimates about $5 per task, including the failures, and says big projects could pass $100. Fagerland's figure to Reuters, about $50 per successful hack, divides total spend by successes. Both rest on the same caveat: NorForge says its "numbers could be off by a clear margin."
What the Victims Said
Fagerland's report names no victims. Reuters identified them by reviewing the operator's Cairn activity. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the attack hit a standalone product support site and the threat was contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors."
Reuters could not establish how much data, if any, was taken. NorForge itself verified one live web shell. It also found hundreds of secrets in the exposed data, credentials and API keys among them, and its scanning tool confirmed 11 percent as valid. It is holding back the panel addresses until they can be taken down.
Third Campaign in Four Weeks
This is not a one-off. By our count it is the third AI-agent intrusion campaign since Tuesday, September 22 that defenders reconstructed from the attacker's own leftovers.
| Report | Tooling and model | Reported scale | How it surfaced |
|---|---|---|---|
| Gambit Security, Tue, Sept 22 | Strix, Cairn and Hermes; Cairn on DeepSeek v4.1 Flash | At least 27 companies hit Sept 10 to 15; over 600,000 card records from two; $25.46 average per completed scan | Recovered attacker server |
| CrowdStrike, Wed, Oct 7 | ARTEX plus Claude Code sessions; DeepSeek V4.1-Flash primary | South Korean banks; Shinhan said about 25,000 customers affected | Open directories with Claude Code histories |
| NorForge and Reuters, Mon, Oct 19 | Cairn; worker claudecode_deepseek-v4.1-flash | Over 1,200 sites tried, over 100 companies breached; about $50 per success (estimate) | Open Cairn panels |
The same cheap DeepSeek model appears in all three. So does a pattern in how the labs' safeguards get routed around. Gambit reported that its operator ran Hermes on Anthropic's Opus 4.6 after newer models refused the requests. In the NorForge case, the harness appears to be Claude Code while the model doing the work is DeepSeek's.
Caveats
The headline figures need care. Task totals and the agents' own success labels are not verified victim counts. The "more than 100" is Reuters' count from one operator's records. The $50 figure is one researcher's rough estimate. And Chinese-language instructions do not establish nationality; NorForge saw financial motives and no obvious state activity.
Cairn's author, who posts as le1xia0, has described the platform as a new kind of multi-agent architecture that was not designed for hacking attacks, according to Reuters.
Our Take
The scary number is not $50. A competent human could probably already break into a neglected storefront for less than a day's pay. What changed is that the human is now optional for the slow part. A short prompt, a cheap model and a patient loop gave one operator over 1,200 attempts in roughly three weeks. Long-tail e-commerce sites that were never worth a person's time are now worth an agent's.
The second lesson is about where safety lives. Frontier labs put their refusals in the model. These campaigns treat the model as a swappable part: an open harness, an open-weight model at a low price, and, per Gambit, an older Claude model when newer ones said no. Refusal training still matters, but it is not a perimeter when the harness takes any model you plug in.
The uncomfortable part is how we know any of this. Three times in a month, defenders learned the details because an attacker left logs, directories or dashboards in public. That is a lagging indicator. The operators who secure their panels will not show up in the next report, and we should assume they exist. For site owners, the practical read is boring and urgent: patch the e-commerce stack, watch for new upload paths and unknown files, and rotate any key that has ever sat in a config file.
Three signposts for the next 60 days: whether Deere, Cummins or SharkNinja disclose more in a regulatory filing, which would tell us the "support site" framing held; whether Cairn adds authentication or other safer defaults to its panel, since NorForge says the exposed panels appear to give full admin control; and whether Anthropic, DeepSeek or OpenRouter say anything about detecting this traffic, since these campaigns appear to have run on paid model access.
Sources: NorForge (Inside Cairn), Reuters via BNN Bloomberg, The Next Web, Unite.AI, Tom's Hardware via Yahoo, Gambit Security, BleepingComputer (Gambit), CrowdStrike (ARTEX), BleepingComputer (ARTEX).