One hacker, a swarm of AI agents and about $5,000. More than 100 companies got hit

The instructions fit in a text message. Fewer than 100 Chinese characters, according to Reuters, telling a crowd of AI agents what to go after. After that, the person who typed them could have gone to bed.

The agents did the rest. Over a couple of weeks they probed online shops in the US, Canada, Australia and Japan, picking at login pages and upload forms for roughly a day at a time until something gave. Reuters reported on October 19 that the campaign got into websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins. The estimated bill for all that machine labor was about $5,000.

The researcher who found it is Snorre Fagerland, principal threat researcher at the security firm NorForge. He did not dress it up. "It's a new world now," he told Reuters.

Caught by their own dashboard

The operation came to light through a very human mistake. Fagerland had been scanning the internet for exposed copies of Cairn, an open-source AI problem-solving platform that has become popular with attackers. Cairn breaks a job into projects, each with a starting point and a goal. Agents post what they learn to a shared board and pick their next move from it. Human operators can drop in hints when the machines get stuck.

Starting around October 2, Fagerland found more than 20 Cairn control panels that appeared to be doing malicious work, and plenty of them were open to anyone who went looking. So he watched. NorForge's write-up has the line of the week about the people running them: "securing their own infrastructure does not appear to be among their strengths."

NorForge sorted what it saw into clusters. The busiest, which it calls AIA0001, ran in Chinese across 14 panels and more than 1,100 attack projects. It went after e-commerce and payment systems. Before handing a shop to Cairn, the operator used Microsoft's Playwright browser automation tool to check that the site actually accepted orders. The agents were only sent where money moved. NorForge says this group seemed interested in access above all, with the aim of keeping "the ability to do more at a later date."

NorForge's report named no victims. Reuters identified them by going through the hacker's Cairn activity itself, then called the companies. Deere said it took "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site holding only product support information, and that the threat was contained. Cummins said it was looking into a possible attack on a website run by a third-party vendor. Two smaller businesses admitted they had been compromised. Reuters could not work out how much data, if any, walked out the door.

Patience is now cheap

The numbers are what should keep security teams up at night. NorForge puts the average success rate at about 10 percent, which sounds low until you remember nobody is paying a salary. Projects that reached their goal took a little under 23 hours on average. One ran for more than five days. No human pen tester spends five days hammering one shoe shop's checkout page, because the hourly rate makes it absurd. An agent has no hourly rate worth mentioning.

Fagerland told Reuters the main campaign burned through roughly $5,000 in tokens, or about $50 per successful break-in. NorForge's own report is more cautious. It puts the average cost of a single task, failures included, at around $5, and says its figures carry a lot of uncertainty. Pick whichever number you like. A working intrusion now costs about as much as dinner for two.

And these were working intrusions. In one case described by Reuters, the agents couldn't find a hole in a large company's public application, so they went sideways. They turned up related infrastructure and a public-facing control panel, then used a subtle data-processing flaw to make the server run their commands. "It's not script kiddie stuff," Fagerland said.

NorForge confirmed one claimed breach on a hardware vendor's site, where it found a live webshell sitting on the server. According to the agent's own account, it got there by chaining unauthorized write access to a memcached session store with unsafe PHP object deserialization in old Zend Framework components. A capable human could build that chain. It would take them a while, and they would want to be paid.

Which AI did the work is murkier. Worker names in the panels pointed to a Claude Code setup running a DeepSeek model, but NorForge did not confirm the configuration. Reuters said the campaign appeared to use a mix of DeepSeek and Anthropic's Claude Code.

Cairn's author, who goes by "le1xia0," didn't answer Reuters' questions. In a post on X they said Cairn was "an innovative type of multi-agent architecture and was not designed for hacking attacks." That may well be true. Plenty of tools were not designed for what they end up doing.

This crew wasn't alone, either. Fagerland saw other actors in the exposed panels: one stole a large set of credit card data, another tried to use agents to rob a cryptocurrency exchange. Reuters notes that in August, Gambit Security caught Russian-speaking extortionists using a Cursor AI tool to breach seven organizations, and in September Gambit documented an agent-driven spree that hit 25 companies and took at least 600,000 credit card records. Bitsight says talk of autonomous agents is surging on cybercrime forums.

The open panels leaked in every direction. NorForge found harvested credentials in them, and TruffleHog verified 11 percent as still valid. Some of the exposed Cairn instances belonged to legitimate red teams, which means their clients' details were sitting in public too.

For defenders, the shift is simple and grim. The patient attacker who tries every form on every forgotten subdomain used to be rare, because patience was expensive. It now runs at about $5 a task. "The development in this field is astounding," Fagerland told Reuters. Somewhere an old storefront running last decade's PHP is getting its fourteenth hour of attention tonight.

Sources: Reuters, NorForge: Inside Cairn, Cybersecurity News.