One Hacker, a Swarm of AI Agents, 100+ Company Websites: What Changes When a Break-In Costs About $50

By Thorsten Meyer | October 30, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

For about two weeks this autumn, a security researcher watched a hacker at work. Or rather, he watched the hacker’s software at work. The operator wrote instructions in fewer than 100 Chinese characters. Then a swarm of AI agents spent days probing online shops, one site after another, and broke into the websites of more than 100 companies, according to Reuters. Among them: farm-equipment maker Deere, appliance maker SharkNinja and engine maker Cummins.

A headline making the rounds today says a “man hires a swarm of AI agents”. Two words in it are wrong. Nobody knows who the operator is; the researcher describes a Chinese-speaking actor, nothing more. And nobody was hired: the attacker used Cairn, a free, open-source agent platform. No source reports an arrest or a charge. What we do have is unusually good evidence, because the attackers left their own control panels open on the internet.

I read the research report from the security firm NorForge, the Reuters investigation, and Gambit Security’s September report on a related campaign. Here is what happened, what is confirmed, and what changes when one person can run many agents.

Key takeaways

• What happened: From 25 September, a Chinese-speaking operator pointed AI agents at online shops in the US, Canada, Australia and Japan. By mid-October the agents had tried more than 1,200 sites, and Reuters counted break-ins at websites of more than 100 companies, based on the attacker’s own records (Reuters, NorForge).
• How we know: NorForge researcher Snorre Fagerland scanned the internet for exposed control panels of Cairn, an open-source platform that coordinates AI agents. He found more than 20 that NorForge links to likely malicious use, and he could watch them almost live.
• The economics: A successful intrusion took a little under 23 hours of automated probing. Fagerland estimates roughly $5,000 in AI costs for the campaign, about $50 per successful hack, and NorForge calls the uncertainty “considerable”.
• What the companies say: Deere took “necessary remediation actions” and has “no indication that sensitive information was accessed”. SharkNinja says a standalone product-support site was hit and the threat contained. Cummins is investigating “a potential cyber-attack on a website operated by one of our third-party vendors” (all to Reuters). Reuters could not establish how much data, if any, was taken.
• Not a one-off: In September, Gambit Security documented a separate agent-driven campaign: at least 27 companies compromised, and at least 600,000 card records taken from two of them.
• What changes: Patience is now nearly free for attackers. Side doors such as support sites, vendor sites and forgotten panels become the main target, defenders drown in automated reports, and the identity of agents becomes a security question.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black

AmazonView Latest Price

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What actually happened

The story starts with another report. In September, Gambit Security recovered a criminal’s staging server and found three “AI harnesses” on it, programs that let AI models act on their own: Hermes, Strix and Cairn. Tools like these often come with a web dashboard. NorForge went looking for those dashboards.

“Most need authorization to access. Most,” the NorForge report says. Using search engines that index servers on the internet, Fagerland found Cairn panels with no password at all. From around 2 October, he identified about two dozen being used for malicious activity, Reuters reports. New ones kept appearing. NorForge sorted them into three activity clusters and published its report on 19 October. The same day, Reuters published its own investigation.

The largest cluster, which NorForge calls AIA0001, writes its tasks in Chinese. NorForge counts more than 1,100 attack projects across 14 of its panels, aimed mostly at the US, Japan and Australia. The goal, in NorForge’s reading: “to gain persistent access to e-commerce/payment infrastructure for later monetization.” In plain words: a hidden way back in, to be used or sold later.

Then Reuters did something the researcher did not. NorForge’s report names no victims. Reuters says it identified them “by independently reviewing the hacker’s Cairn activity” and contacted them. Two smaller businesses acknowledged being compromised. Other victims did not reply.

How a swarm works, without the recipe

Think of Cairn as a shared whiteboard in an incident room, except the room is full of software. You give it a starting point and a goal. Each agent pins up what it has found, a “fact”, and what it plans to try next, an “intent”. The next agent reads the board and builds on it. The operator can pin a hint, but does not have to stay in the room.

NorForge stresses that Cairn is more general than a hacking tool: “It is a state-based problem solving engine, moving step by step in the general direction of a defined solution.” Its author, who goes by le1xia0, wrote on X that Cairn “was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention” (quoted by Reuters).

The criminal use around it looked industrial. NorForge describes an automated feed: shop websites ranked by traffic and checked automatically in a browser before they were handed to the agents. Then the agents worked. For AIA0001’s successful projects, NorForge measured “a little under 23 hours” from start to goal, with about 140 facts per project. One project ran for more than five days.

What impressed Fagerland most was the improvisation. In one case, Reuters reports, the agents found no weakness in a big company’s public application. So they went around it. They searched records for related infrastructure, found a public control panel with a subtle flaw in how it processed data, and after hours of trial and error “reported leveraging it” to make the server run their commands. That last part is the agents’ own account. “It’s not script kiddie stuff,” Fagerland told Reuters.

I am deliberately stopping there. NorForge publishes more technical detail for defenders. You won’t find attack steps, tools or target lists here.

Confirmed, estimated, unknown

This story mixes hard evidence with estimates. It helps to keep them apart.

Checked by someone:

• NorForge fetched the address of one claimed back door at a large hardware-parts vendor. It “did indeed serve an uploader webshell”, a hidden upload form that an attacker can later swap for something worse.
• NorForge says it validated one intrusion chain at a very large US retailer.
• Reuters identified victims from the attacker’s records and got statements from Deere, SharkNinja and Cummins.

Estimates:

• Success rate: “a reasonable assumption” of about 10% across the harnesses NorForge saw. With more than 1,100 projects in the biggest cluster, that fits Reuters’ count of 100+ companies, but NorForge warns the clusters “are not directly comparable”.
• Cost: about $5 per task on average, more than $100 for long projects, and roughly $5,000 in total, or about $50 per successful hack. NorForge: “numbers could be off by a clear margin.”
• Models: AIA0001’s tasks ran under a worker named “claudecode_deepseek-v4.1-flash”, which NorForge says “could mean” Anthropic’s Claude Code harness running DeepSeek’s 4.1 Flash model. Reuters writes the campaign “appeared” to use both. Neither confirmed it.

Unknown:

• Who the operator is. NorForge describes the language of the tasks, not a person. It says all clusters “appeared to have financial motivation” and it saw “no obvious state-sponsored intrusion activity”.
• How much data left the companies. Reuters “could not ascertain” it.
• Whether the panels are offline. NorForge was trying to get them taken down, which “depends a lot on how well the hosters respond”. I found no update on the outcome.

Not a one-off

Gambit Security’s September report describes a different operator. Between 10 and 15 September, that campaign launched 105 attack projects, and “at least 27 companies were compromised to varying degrees”. From two of them, it took at least 600,000 unexpired card records. By the operator’s own cost review, the average was $25.46 per targeted company. The human typed 1,951 prompts across 260 sessions, only a few per target.

Gambit names models too. The orchestrating agent, Hermes, used Anthropic’s Opus 4.6 “after newer models refused its requests”, and the exploitation agent, Cairn, ran on a DeepSeek model. Gambit calls its work an interim report and warns that parts rest on the agents’ own claims. Reuters adds that Bitsight sees talk about autonomous agents surging on criminal forums.

For a different case, where “AI-assisted” turned out to be an inference rather than a proof, see my piece on the PHP2Shell chain that took over 25 Palo Alto servers.

What changes when one person can run a swarm

The individual weaknesses here are not new: old software, unprotected uploads, a forgotten admin page. What is new is the cost of trying, and the patience.

1. Patience is now free. A human attacker gets tired, makes noise and moves on. An agent pokes politely for 23 hours and doesn’t mind failing nine times out of ten. Gambit puts it bluntly: “Detection thresholds, change windows and on-call rotations were calibrated for human pace.” Alerts tuned for a loud burst can miss a quiet, day-long conversation with your shop.

2. Rate limits help, but they are not the defence. Limiting requests per address still raises the price a little. But when an attempt costs around $5, slowing it down does not stop it. What stops it is having less to find: fewer exposed pages, fewer old components, no upload forms nobody needs.

3. The side door is the target. Look at the companies’ statements: a standalone support site, a site run by a vendor, a control panel next to the main application. Agents go around the hardened front. If it carries your name and is online, it is in scope, including what agencies and suppliers run for you.

4. The flood hits defenders too. The same automation produces piles of reports. As of 1 October, Google stopped accepting product vulnerability reports to its open-source bug bounty program. Its reason, in a post on X: “a significant rise in automated submissions, the vast majority of which are not valid” (as reported by Help Net Security). When the inbox fills with machine-written reports, triage capacity becomes a security control.

5. Agent identity matters. Legitimate agents are starting to identify themselves. The IETF’s webbotauth working group “will standardize methods for cryptographically authenticating automated clients”, including AI agents acting for users, and its current draft builds on HTTP Message Signatures. Criminal swarms won’t sign. But if the good bots prove who they are, the anonymous rest can get a stricter policy. That’s my reading, not a promise: it shrinks the haystack, it doesn’t find the needle.

6. Your own agents and testers are attack surface. NorForge also found apparently legitimate red teams that had put real customer tests on unsecured panels. Its scan of the exposed data turned up “literally hundreds of secrets”, 11% of them still valid. The report’s verdict: “having your site tested on an open Cairn instance is often a serious security issue, regardless of outcome of the test.”

What this means for companies

• Inventory the edges. List every site and panel under your name, including support portals, campaign microsites and vendor-run pages. Retire what nobody owns.
• Patch the edge first. Old components on side sites are what cheap agents find.
• Watch for slow persistence, not just spikes: long sessions probing many pages, and new files appearing in web folders, especially upload forms nobody deployed.
• Ask your vendors who runs your outsourced sites, how fast they patch, and how they would tell you about a breach.
• Plan for recovery, not just prevention. Gambit’s advice: agree on your “minimum viable business” and test that you can actually restore it.
• Vet AI-assisted pentests. Ask where the testing tool’s dashboard lives, who can reach it, and where your findings and credentials are stored.
• Budget for triage. If you run a bug bounty or a security inbox, plan for more automated reports, most of them noise.

What this means for users

The targets were online shops and payment systems, so for you the risk is mostly your card and your shop accounts.

• Turn on card alerts for every purchase, so you see misuse within minutes.
• Use a phone wallet or a virtual card at small shops where you can. A token or single-use number is worth less to a thief than your real card number.
• Use unique passwords with a password manager, and two-factor login where it is offered.
• Be wary of breach emails. If a shop writes that you were affected, don’t click its login link. Go to the site yourself.
• Check your statements once a month and report charges you don’t recognize to your bank quickly.

Honest limits

• NorForge sells sandboxing for AI agents, so this topic is close to its business. Reuters corroborated key parts by reviewing the data itself and reaching victims.
• “100+ companies” is Reuters’ count from the attacker’s own records. “Broke into” covers very different depths, from a support site to a back door.
• Costs and success rates are the researcher’s estimates. The model names come from a worker label, not from the AI providers.
• No company in this case has described stolen customer data, and Reuters could not establish whether data was taken.
• This is a snapshot. NorForge: “Models and harnesses evolve very quickly.”
• I did not access any panel or attacker system. Everything here comes from the published reports.

The takeaway

The final twist is almost funny. We can see all this only because the attackers forgot basic security themselves. NorForge: “Whatever offensive expertise these operators possess, securing their own infrastructure does not appear to be among their strengths.”

Don’t count on that next time. A break-in no longer needs a team and a month. It needs a short instruction, a free platform and, by one estimate, about $50 in AI costs. So shrink what is exposed, and watch for patience, not just speed.

Related on Thorsten Meyer AI

• Two Days From Patch to Root: How a PHP2Shell Chain Took Over 25 Palo Alto Servers
• An AI Anyone Can Download Turned Firefox Fixes Into Working Attacks
• CVEs Are Going to the Moon: AI, Bug Hunters and the Patch Gap
• Attackers Now Go After Your AI Tools: Stolen Sessions, Leaked Agent Logs and Hidden Reasoning
• Anthropic’s AI Built Five Working Attack Chains: What We Can Verify
• AI Agents Now Hold Our Keys: How to Delegate Without Handing Over the Vault
• 72 Hours of Security Headlines Expose Failures Across the Internet

Sources

• NorForge (Snorre Fagerland): Inside Cairn: Open Windows into massive AI-Driven Cyber Operations, 19 October 2026
• Reuters: How one hacker used AI agents and a few thousand dollars to break into scores of sites, 19 October 2026, read via the syndicated copy on Aaj English TV
• Gambit Security (Eyal Sela): AI Agents Are Hacking Online Retailers for $25 a Company, 22 September 2026
• SecurityWeek: AI Platform Cairn Abused to Hack Over 100 Organizations, 20 October 2026
• Google Bug Hunters: Open Source Software VRP rules, read 30 October 2026; Help Net Security: AI slop submissions force Google to freeze its open-source bug bounty, 5 October 2026
• IETF: webbotauth working group charter and the draft HTTP Message Signatures for automated traffic
• The story resurfaced on 30 October through Hacker News and a Futurism piece from 22 October; both rely on Reuters and NorForge and are not used as sources here.

Researched and drafted with AI assistance, including Anthropic’s Claude.