$50 a breach: one hacker's AI agents got into more than 100 websites

The attacker described their preferred tactics in fewer than 100 Chinese characters and left the rest to AI agents. According to security firm NorForge, those agents tried to break into more than 1,200 websites and got into over 100. For defenders, the key figure is the price: an estimated $50 per successful intrusion.

The agents worked around the clock while a human just supplied targets

Snorre Fagerland, principal threat researcher at NorForge, published the findings on Monday, October 19. The attacker used Cairn, an open-source platform that calls itself a “general-purpose problem-solving engine.” An operator sets a target and a goal. The agents then work step by step and post what they find to a shared board. The human can add hints, but does not have to.

Many operators left their Cairn control panels open on the web. NorForge started finding them through internet scanning around October 2 and judged more than 20 of them likely malicious. The busiest group wrote in Chinese and ran 14 panels with more than 1,100 attack projects. It went after online shops in the US, Canada, Japan and Australia. The agents were told to get code running on each site and plant an uploader web shell. Successful intrusions took a little under 23 hours on average.

NorForge does not name the victims. Reuters identified some of them from the attacker's own records, including Deere, SharkNinja and Cummins. Deere said there is no indication that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and that the threat is contained. Cummins is investigating a site run for it by a third-party vendor. How much data, if any, was taken is still unknown.

A breach for the price of dinner changes who is worth attacking

Fagerland estimates the campaign burned about $5,000 worth of tokens, or roughly $50 per successful hack. NorForge's report puts the average at about $5 per task, counting failed attempts, with a success rate near 10%. The report itself says the uncertainty is considerable.

Even a rough number changes the math. A human attacker picks targets that are worth their time. At $50 a breach and with no supervision needed, a mid-sized online shop, an old support site or a vendor-run microsite all become worth a try. Those are exactly the kinds of sites that show up on the victim list. For security teams, a forgotten website is no longer safe just because nobody finds it interesting.

The tooling deserves attention too. According to NorForge, every task ran on a worker named claudecode_deepseek-v4.1-flash. The firm reads that as a possible pairing of the Claude Code harness with DeepSeek's low-cost V4.1 Flash model. If that is right, the attacker took a capable agent harness and slotted in a model that will not push back. The safety filters of the big model vendors would then play only a minor role.

Open panels exposed the attackers, and defenders cannot count on that again

The campaign only came to light because the attackers failed to secure their own infrastructure. The open panels also leaked hundreds of the victims' credentials and API keys. The Trufflehog scanner verified 11% of them as valid. Some legitimate penetration testing firms had left client work exposed in the same way.

The next operator will lock the panel, and defenders will only see the result: an uploaded file in a shop's directory. Most of the numbers have also not been independently verified. The Next Web says it did not confirm the intrusions itself, and the victims' statements cover only individual sites. A 10% success rate also means nine out of ten attempts failed. The agents win on persistence and on the low cost of each try.

The deciding signal is whether findings like this start arriving every month

NorForge is working with Reuters to warn victims and is asking hosting firms to take the panels down. Cairn's author, who posts on X as le1xia0, says the platform was never a hacking tool and that misuse is a human decision.

The stronger signal will come from the next reports. In September, Gambit Security found Cairn on an attacker's server and said the attacker's agents stole at least 600,000 payment card records from 25 companies. If findings like these keep piling up, companies will have to treat the inventory of their own websites and vendor microsites as seriously as patching their main application.

Lilith's verdict

Fifty dollars used to buy an attacker less than an hour of someone else's work. Now it hires a tireless burglar who spends a full day and night rummaging through a forgotten site full of vacuum cleaner manuals.