A single hacker broke into websites at more than 100 companies in recent weeks, and AI agents did nearly all of the work. The campaign cost about $5,000 in model usage, roughly $50 per successful intrusion.[1]

Reuters reported the case on Oct. 19 after reviewing a NorForge investigation. Snorre Fagerland, principal threat researcher at the security firm, spent early October scanning the open internet for exposed dashboards belonging to AI hacking tools, found about two dozen in active criminal use, and then watched the intrusions unfold through those same dashboards.[1][2]

A dashboard left wide open

The tool at the center is Cairn, an open-source problem-solving platform that coordinates multiple AI agents. An operator gives it a starting point and a goal, and the agents work toward that goal in steps, posting each finding to a shared blackboard that every worker can read. Nothing in the design is built for crime, but it maps cleanly onto penetration testing.[2]

Cairn panels are ordinary web applications, so Shodan and Censys can find them. Many operators secured theirs. The ones that mattered did not. NorForge found more than 20 unprotected panels tied to likely malicious activity, including 14 that belonged to one Chinese-speaking group it tracks as AIA0001.[2]

Fewer than 100 characters of instructions

That group ran a lean operation. The operator wrote task briefs shorter than 100 Chinese characters, then let the agents take over. One brief quoted in the NorForge report listed confirmed live shopping sites in the US, Canada, Japan and Australia with traffic between 200,000 and 1.5 million visits, each pre-checked with Playwright to confirm orders could be placed. The objective was unauthenticated remote code execution. The payload was an uploader shell, deliberately not a command shell.[2]

The work ran under a worker named claudecode_deepseek-v4.1-flash, which points to a Claude Code harness driving the DeepSeek 4.1 Flash model, and the agent container still carried traces of an old Tencent capture-the-flag setup.[2] Fagerland put the token bill for the campaign at about $5,000, or roughly $50 for every site that fell.[1]

Twenty-three hours per break-in

By late last week, the agents had tried more than 1,200 sites. Success averaged around 10 percent across the panels NorForge examined. For projects that reached their goal, the average time from start to a working shell was just under 23 hours, with about 140 recorded findings per project. One ran for more than five days.[1][2]

The techniques were not crude. In one intrusion, the agents found nothing exploitable in the public application of a large company, so they dug through digital records for related infrastructure, located a public control panel, spotted a subtle flaw in how it processed data, and spent hours working out how to make the server run their commands. Fagerland told Reuters the result was not the work of amateurs.[1]

NorForge independently verified a second case where an agent found the single cookie setting that routed requests to a vulnerable backend server. A third chain began with unauthorized write access to a memcached session store, then used unsafe PHP object deserialization and a gadget chain in legacy Zend Framework components to land a shell. NorForge tested one of the resulting shells against the live site of a hardware vendor and found the upload form still responding.[2]

What the victims said

Reuters identified Deere, SharkNinja and Cummins among the victims by reviewing the project data. Deere said it took "necessary remediation actions" and had no indication that sensitive information was accessed. SharkNinja said the intrusion hit a standalone site holding only product support information and that the threat was contained. Cummins said it was investigating a reported attack on a site operated by a third-party vendor. Two smaller businesses acknowledged compromises, and other companies listed in the data did not respond.[1]

Whether data left those systems remains unclear. Reuters could not establish how much, if anything, was extracted. The author of Cairn, who posts as le1xia0, told Reuters the platform "was not designed for hacking attacks" and that malicious use was not the intent.[1]

The attackers had their own security problem

Every exposed panel was unauthenticated, which handed Fagerland the full administrative view: project controls, agent instructions, harvested credentials. He ran the Trufflehog secret scanner across the data and found hundreds of credentials, 11 percent of them verified as valid.[2]

One English-speaking cluster left SSH logins for its own staging servers inside the task text. Another used the same tool to move funds between crypto wallets and to hunt card data; Reuters ties a related September campaign, documented by Gambit Security, to breaches at 25 companies and at least 600,000 stolen card records. Bitsight reported last week that discussion of autonomous agents is climbing across cybercrime forums.[1]

The sloppiness cuts both ways. It widened the exposure of the victims to anyone who stumbled onto a panel, and it shows the operators are not the disciplined professionals their tooling suggests. NorForge spent the past week helping Reuters notify victims and asking hosting providers to take the panels offline.[2]

Microsoft puts the controls outside the model

The defensive response landed the same day. Microsoft extended Project Perception with Guardian Agents, monitoring agents that watch other agents and act when risk rises. Administrators can let an agent keep reading data while blocking its writes, require human approval for a high-stakes step, or shut it down. The capability sits inside Microsoft 365 E7, listed at $99 per user per month, and the company expanded local agent discovery from 25 types to 60, covering Claude Code, Codex and GitHub Copilot.[3][4]

Microsoft also introduced Dynamic Permissions, which start an agent with no standing access and scope its authority to a single task, plus Dynamic Agent Risk, which scores each agent on configuration, reachable resources and whether its behavior drifts from the assigned work.[3]

"The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least," Nadella wrote in the post Microsoft is building on.[3]

The features are in private preview, with wider availability planned around the Microsoft Ignite conference on Nov. 17-19.[4]

What changes for defenders

The cost curve is the part worth internalizing. An intrusion that once needed a skilled operator and weeks of manual probing now runs overnight for the price of a decent dinner, and the person running it does not need to understand the exploit the agent assembles.[1][2]

That pushes the work back toward basics the victims appear to have skipped: patching legacy frameworks, locking down session stores, and watching outbound traffic from web servers. The NorForge report makes a related point about the panels themselves. A security team that cannot keep its own tooling off the public internet should assume someone else is already reading it.[2]

Both stories from this week point at the same gap. The attack tooling matured faster than the operational discipline around it, on both sides of the fight.

Sources

1. Reuters: How one hacker used AI agents and a few thousand dollars to break into scores of sites
2. NorForge: Inside Cairn, open windows into massive AI-driven cyber operations
3. Microsoft Security Blog: Agents are your newest insiders
4. GeekWire: Microsoft unveils tools to monitor and corral rogue AI agents