One operator's AI agents breached over 100 company sites for about $50 each

A single operator working with autonomous AI agents broke into websites belonging to more than 100 companies at an estimated cost of about $50 per successful intrusion, according to a NorForge report by researcher Snorre Fagerland. Reuters, which reviewed activity on exposed control panels, corroborated the scale: more than 100 compromised companies out of over 1,200 sites the agents probed.

The findings were published on 19 October 2026 and are summarised in a dev.to write-up. The campaign began around 25 September 2026 and ran on Cairn, an open-source agent platform. According to NorForge, the operator supplied only brief, high-level instructions in Chinese — fewer than 100 characters — and left nearly all of the actual work to the agents.

How the campaign worked

NorForge says the agents' objective was to achieve code execution on target sites and then plant an uploader web shell for persistent access. Most targets were e-commerce and payment-related websites in the US, Canada, Australia and Japan. Candidate sites were ranked by traffic and pre-checked with Playwright before being handed to Cairn.

The logs carried the worker identifier claudecode_deepseek-v4.1-flash, which NorForge interprets as Claude Code orchestrating DeepSeek V4.1 Flash — an inference rather than a confirmed configuration. The largest activity cluster, labelled AIA0001, operated in Chinese and spanned more than 1,100 projects across 14 control panels.

Fagerland discovered the operation in early October by scanning for publicly accessible Cairn panels, turning up roughly two dozen malicious instances. That exposure is also why the campaign is visible at all: as the write-up points out, once operators lock down those panels, outside observation of similar activity becomes far harder.

The numbers

NorForge's figures, which the write-up stresses are researcher estimates rather than confirmed billing:

• Sites attempted: more than 1,200, per NorForge and Reuters
• Companies breached: more than 100, per NorForge and Reuters
• Average time per successful breach: roughly 23 hours
• Estimated total token spend: about $5,000, or roughly $50 per successful breach
• Approximate success rate: around 10 percent

Victims named so far

After examining panel activity, Reuters identified three affected companies. John Deere said remediation steps had been taken and that it had seen no sign sensitive data was accessed. SharkNinja said a standalone product-support site was affected and the threat had been contained. Cummins said it was looking into a possible intrusion at a third-party vendor's site. Reuters could not determine how much data, if any, was exfiltrated.

Caveats to keep in mind

The cost figures are calculations based on observed activity and typical token pricing; the write-up notes that quantisation choices, caching or provider discounts could move the total. The visibility itself depended on panels being left exposed. The campaign is also distinct from an earlier September 2026 Cairn-related operation, reported by Forbes and Gambit Security, that involved Hermes and credit-card theft.

Why it matters

The headline figure changes the economics of intrusion. Traditional targeted attacks typically involve substantial manual effort, costlier tooling or lower hit rates; here the operator's marginal cost was mostly tokens, and agents could run against many targets in parallel. Even with roughly nine in ten attempts failing, the absolute output — 100-plus company breaches driven by one person writing short prompts — is significant.

For defenders, the practical lessons are twofold. First, teams running or hosting agent frameworks should treat the control plane as sensitive: exposed dashboards, default credentials and unauthenticated panels are what made this activity observable. Second, the attacks themselves were conventional — agents hunting for code-execution paths and dropping web shells — so existing web-shell detection, file-integrity monitoring and egress controls still apply. The novelty lies in the scale and minimal human involvement, not a new vulnerability class.

Whether this pattern becomes commonplace depends on questions the reporting does not yet answer: how many similar operators are running on panels that are not exposed, whether the success rate holds as targets start blocking common agent fingerprints, and whether other open agent harnesses attract the same misuse.