One Hacker Used AI Agents to Breach 100+ Websites. It Cost $5,000.

The $5,000 hacking spree

On Monday, October 19, Reuters published an exclusive: a Chinese-speaking hacker broke into the websites of more than 100 companies — including Deere, SharkNinja, and Cummins — while doing almost none of the work himself. The spree, which began September 25, was outsourced almost entirely to AI agents that spent hours autonomously probing sites, testing vulnerabilities, and planting webshells. The token bill for the whole operation: roughly $5,000. About $50 per successful hack.

Security researcher Snorre Fagerland of NorForge got the full picture because the hackers made one crucial mistake: they left their AI agents' control panels exposed on the public internet with no login at all. Scanning for exposed instances of the open-source agent platform Cairn around October 2, he found about two dozen used for malicious activity — and peered over the cybercriminals' shoulders in real time.

"It's a new world now," Fagerland told Reuters. "It's not script kiddie stuff."

How the campaign actually worked

NorForge's report — "Inside Cairn: Open Windows into Massive AI-Driven Cyber Operations" — is the most detailed look yet at offensive AI agents in the wild. Cairn isn't a hacking tool. It's a state-based problem-solving engine: you define a start point and a goal, and the system works through cycles of intents (what the agent decided next) and facts (what it discovered), with every fact posted to a project blackboard the human operator can drop hints onto. It's general-purpose software that happens to be good at penetration testing.

The most active cluster ran over 1,100 attack projects across 14 panels, aimed at e-commerce and payment infrastructure in the US, Japan, and Australia — shopping sites with 200,000 to 1.5 million monthly visitors, pre-screened with Playwright to confirm orders could be placed. The goal was unauthenticated remote code execution — SQLi, deserialization, file uploads, SSRF — but the preferred payload was deliberately boring: a simple uploader shell, a bare HTML file-upload form plus PHP's move_uploaded_file, for persistent access to monetize later.

Two details make this feel like a turning point. First, the human's instructions were terse — fewer than 100 Chinese characters, roughly a tweet. One agent failed against a big company's public app, so it found associated infrastructure on its own, located a public-facing control panel, found a subtle flaw in how it processed data, and after hours of trial and error, tricked the server into running malicious commands. Second, the economics: about 23 hours of probing and 140 facts per project, roughly $5 per task, a 10 percent success rate. That's why $5,000 buys 100 intrusions. The models were reportedly DeepSeek plus Claude Code — the bill for attacking you can be paid in the cheapest model on the market, not the smartest.

The hackers left their dashboards open

The panels Fagerland found were completely unprotected — no login, no auth. He wasn't just reading the campaign's playbook; he had the harness's full administrative functionality. He could have stopped projects, redirected agents to different targets, restarted old ones. Anyone stumbling across those panels could do the same. The attacker's own offensive infrastructure was open to the whole internet.

Trufflehog scanning over the exposed data turned up hundreds of secrets — API keys, credentials harvested from elsewhere — with 11 percent verified as valid. NorForge also found apparently legitimate red-team operations on unsecured panels, meaning real companies' clients' secrets were sitting in the open too.

Stranger quirks: one cluster's setup looked repurposed from a Tencent CTF competition framework — NorForge says criminals almost certainly just reused the tooling, no reason to think Tencent was involved. A buggy domain normalizer stripped one "w" too many from "www", mangling "Wholesale" into "holesale", which made related panels easy to spot. And one verified breach against a large hardware parts vendor ran through write access to a memcached session store plus unsafe PHP deserialization through legacy Zend Framework gadget chains.

The English-speaking cluster's tasking notes, typos and all: "upload web shell in hidden dirctory deep inside not on home dirctory and name it somthing normal like confirm.php etc and give me link." A human telling an autonomous agent what to do, and the agent doing it.

It's not the first AI-agent hacking spree

This is the second major campaign of its kind in two months. In September, Gambit Security documented a separate Chinese-speaking operation using three open-source harnesses — Strix for discovery, Cairn for exploitation, Hermes for orchestration — against 27 companies including a Fortune 500 hospitality firm and a major US airline. That one stole 600,000+ unexpired credit card records and cost about $7,000 over four weeks. Different evidence, different operator, same playbook.

The pattern is becoming an industry. Bitsight said discussions about using autonomous agents are surging across cybercriminal forums. And on October 19 — the same day the Reuters story broke — Microsoft announced new enterprise controls treating AI agents as potential insider threats: "Guardian Agents" that supervise what each agent does and adjust permissions as risk changes. Agents "can be manipulated, make mistakes, or be compromised, and they can run continuously at machine speed." AI agents are on both sides of the security problem now.

What this means for your defenses

The companies told Reuters the damage was limited: Deere took "necessary remediation actions" with no indication sensitive information was accessed; SharkNinja said a standalone product-support site was hit and contained; Cummins is investigating a vendor-operated website. Reuters could not establish how much data was stolen.

Look beyond the main application. The most interesting intrusion didn't start with the target's homepage — it started with associated infrastructure, a public-facing control panel the agent found on its own. Your audit surface is your vendor portals, admin panels, and session stores, not just your app.

Hunt for file-upload forms where they shouldn't be. The attacker's go-to payload was a bare upload form in a hidden directory with a normal-sounding name like confirm.php. Make sure file-integrity monitoring watches for unexpected upload handlers appearing in odd places.

Treat agent platforms like admin panels. If your team runs Cairn or anything like it — even for legitimate red-teaming — it needs authentication by default, segmentation off the public internet, and logging. An exposed agent dashboard isn't just a leak; strangers can take over your offensive tooling.

Detect the probing, not just the breach. A 23-hour intrusion with 140 facts per project isn't a single suspicious request — it's sustained automated behavior from the same origin. Signature detection misses agents because agents adapt when blocked. Behavior-based monitoring is the answer NorForge's findings point to.

The takeaway

The headline number — 100+ breaches for $5,000 — will be quoted for months, and it should be. But the deeper shift is operational: hacking is becoming a logistics problem rather than a skill problem. A 100-character instruction plus a reasoning engine plus 23 hours of unsupervised probing equals a breach. The attacker didn't need to know how to exploit a memcached session store. The agent figured that out, adapted when blocked, and reported back.

If you're responsible for a website, the practical move this week is the boring one: audit which agent platforms, panels, and admin interfaces are reachable from the public internet; review upload endpoints for handlers that shouldn't exist; and make sure your logging can spot hours of patient probing. The hackers' dashboards were wide open. Yours shouldn't be.