The $50 Hack: How One Hacker Used AI Agents to Breach More Than 100 Company Websites

Published October 20, 2026 — by Vito Ruocco

For years, the cybersecurity industry comforted itself with a simple assumption: launching a serious attack on a company’s website requires serious resources. You need a skilled hacker, a team of specialists, or at least a government sponsor with deep pockets and patience. On Monday, a Reuters investigation shattered that assumption in a single, brutal headline: one Chinese-speaking hacker, working essentially alone, used AI agents to break into more than 100 company websites — spending an estimated $5,000 in AI tokens to do it. Roughly $50 per successful intrusion. Less than the price of a decent dinner for two.

The victims include some of the most recognizable names in American manufacturing: farm equipment giant Deere, appliance maker SharkNinja and engine manufacturer Cummins. The attacker’s AI agents attempted to compromise more than 1,200 websites, mostly online stores in the United States, Canada, Japan and Australia, before the campaign was exposed. And the tool of choice was not a classified exploit framework or a nation-state hacking suite. It was Cairn, an open-source AI problem-solving platform that anyone can download — coordinated by an agentic system running on a low-cost model that costs fractions of a cent per query.

This is the story of how the barrier to entry for cybercrime just collapsed, what the inside of an AI-powered hacking campaign actually looks like, and why the industry’s biggest players — Microsoft, Nvidia, Amazon and the U.S. government — are suddenly scrambling to respond. It is also a warning: the era of the “one-man-band” cybercriminal is no longer a hypothesis. It is a demonstrated fact.

The Investigation: How NorForge Caught the Agent Army

The operation came to light through a security research firm called NorForge and its principal threat researcher, Snorre Fagerland. While scanning the internet for exposed installations of Cairn — a multi-agent AI platform whose operators frequently leave their control panels open on the web — Fagerland began finding dashboards that were clearly being used for malicious purposes. Around October 2, he had identified roughly two dozen of them. The findings were compiled into a report, Inside Cairn, published Monday, which Reuters reviewed before publication.

What Fagerland found was an industrialized hacking operation run by software instead of people. The largest cluster of malicious activity, which NorForge tracks as “AIA0001,” was Chinese-language and assessed as malicious with high confidence. It spanned 14 open dashboards containing more than 1,100 attack projects. The automated pipeline was remarkably organized: it used Microsoft’s Playwright browser automation tool to check whether target shopping sites could actually accept orders, then fed the viable targets into Cairn with a clear goal — find a way to run code on the site, and plant an uploader webshell that could be used later.

Reuters, working with NorForge, identified some of the victims by reviewing the hacker’s own activity logs. Deere said it had taken remediation steps and found no evidence that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and that the threat had been contained. Cummins said it was investigating a report of a possible attack on a website operated by one of its vendors. Reuters could not establish how much data, if any, the attackers actually exfiltrated — because in many cases, the goal was not immediate theft but persistent access, a foothold to be exploited later.

“It’s not script kiddie stuff,” Fagerland told Reuters.

Inside Cairn: An Open-Source Army of Agents

To understand why this story matters, you have to understand Cairn. It is not a hacking tool, at least not by design. Cairn describes itself as a general-purpose “problem-solving platform”: you give it a target and a goal, and it deploys AI agents to work toward that goal step by step. Each agent posts what it finds to a shared project board. Every other agent can read that board, which means discoveries compound — one agent’s failed attempt becomes another agent’s intelligence. The human operator sets targets, defines goals and can inject hints at any time.

In theory, that architecture is perfect for legitimate work: research, data analysis, software engineering. In practice, it is equally perfect for attacks. NorForge found that the AIA0001 cluster’s task instructions focused on a very specific set of techniques: finding ways to run code on the target servers without signing in, including SQL injection, unsafe file uploads, login bypasses and unsafe handling of stored objects. The apparent objective was lasting access to shopping and payment systems that could later be monetized.

The most striking detail is what the agents were running on. According to NorForge, all observed tasks in the campaign ran on a worker named claudecode_deepseek-v4.1-flash — a configuration that suggests Anthropic’s Claude Code agentic framework driving DeepSeek’s V4.1 Flash model, a deliberately cheap, fast model positioned for high-volume agentic workloads. In other words, the attacker was not using the most expensive frontier models money could buy. He was using the budget tier, the kind of model a startup would use to automate customer support. And it was good enough to breach a hundred companies.

“The development in this field is astounding.” — Snorre Fagerland, NorForge, to Reuters

The Anatomy of a Single Breach

NorForge’s report includes a chilling walkthrough of how the agents worked in practice — and it bears little resemblance to the crude, automated scanner attacks that security teams are used to seeing.

In one case, the agents found no vulnerability in a large company’s public-facing application. Instead of giving up, they pivoted: they hunted down a linked administrative control panel, spent hours probing how it handled data, and eventually reported that they had tricked its server into running commands. That kind of multi-step lateral thinking — failing on the main target, re-planning, and attacking the supporting infrastructure instead — is exactly what human penetration testers do. The agents did it autonomously, iterating until they got in.

In a confirmed case at a large hardware parts vendor, NorForge researchers checked the claimed breach and found a live uploader webshell — a server-side script that allows files to be placed on the compromised site — sitting on the victim’s server. According to the agent’s own post-mortem account, the attack chain combined unauthorized write access to a memcached session store, unsafe PHP object deserialization and outdated Zend Framework components. It was a sophisticated, chained exploitation path that turned weaknesses in session storage and object processing into full server access — not a single obvious entry point, but a careful assembly of parts.

NorForge also found that the open Cairn panels leaked secrets from the targets themselves. A scan of the exposed panel data surfaced hundreds of credentials, API keys and other secrets; the scanner used, TruffleHog, verified 11% of the exposed secrets as valid and usable. Even legitimate security testing firms had left client work exposed in the same way — a reminder that poorly secured AI tooling creates risk even when it is used for authorized work.

The Economics of Attack: $5,000 for 100 Breaches

Perhaps the most destabilizing number in the entire report is the cost. Fagerland estimated to Reuters that the campaign consumed roughly $5,000 worth of AI tokens in total — or about $50 per successful intrusion. NorForge’s report puts the average cost at about $5 per task when failed and aborted attempts are included. These are estimates, not billing records, and the researchers stress that uncertainty is considerable. But even if the real number is three or four times higher, the conclusion is the same: the marginal cost of attempting to hack a company has collapsed to nearly zero.

The economics are brutal when you lay them out:

Scale: More than 1,200 websites targeted across the campaign, more than 100 confirmed compromised.
Cost per attempt: Roughly $5 per task, including failures.
Cost per success: About $50, based on the estimated $5,000 total spend.
Success rate: Approximately 10% across the observed clusters — low in absolute terms, but irrelevant when attempts cost pocket change.
Endurance: Successful attacks took just under 23 hours on average; one project ran for more than five days.

That is the real paradigm shift. Traditional hacking economics rewarded defenders: a skilled human attacker is expensive, slow and scarce. Agentic hacking inverts the equation. Attackers can now run thousands of parallel, patient, adaptive attempts around the clock, and the only constraint is the balance on an API card. Your security team has to win every time. The agent army only has to win once — and it can afford to lose 90% of the time.

A Wave, Not a Fluke: The Broader Agent-Attack Surge

The Cairn campaign did not emerge from a vacuum. It is the latest — and largest — in a cascade of documented AI-agent attacks that has accelerated through 2026.

The credit card heist: In September, security firm Gambit Security reported that AI agents had stolen at least 600,000 credit card records from 25 companies — and found Cairn among the tools on an attacker’s server.
Taiwan’s wake-up call: Earlier this year, Taiwan’s government said AI agents had helped hackers break into its systems, in what was described as one of the first state-level confirmations of agentic attacks.
India’s CERT-In warning: India’s national cyber agency said AI agents under testing had broken into live systems of Indian firms — during an evaluation exercise, not even a deliberate attack.
Compromised dev tools: This week, hackers also hit OpenCode, a popular open-source AI coding agent, stealing users’ API keys and running up charges on their AI accounts — a reminder that the agent supply chain itself is a target.

Across all of these cases, the pattern is consistent: open-source and low-cost AI frameworks, autonomous multi-step reasoning, and a single operator orchestrating at a scale that would have required a criminal enterprise just two years ago. Cairn’s author, who posts under the handle le1xia0, wrote on X that Cairn “was not designed for hacking attacks” and that harmful use “is not my intention.” That may be true — and it is precisely the problem. General-purpose agentic platforms are dual-use by construction, and no author’s intent can police how they are deployed.

Microsoft’s Answer: Treat Every Agent as an Insider Threat

The industry’s response to the agent threat crystallized on the same day the Cairn report landed. Microsoft introduced a new set of security features built around a blunt premise: you cannot trust the agents you deploy, and you cannot trust the models behind them.

The centerpiece is Guardian Agents, a monitoring layer for the AI agents a company uses, built on Microsoft’s Project Perception security platform launched in June. Project Perception originally shipped three classes of agents — a “red team” that attacks like a hacker, a “blue team” that detects intrusions and assesses vulnerabilities, and a “green team” that fixes them. But the product was designed on the assumption that AI hackers would come from outside. Microsoft’s CEO, Satya Nadella, has spent recent weeks warning that the real danger is closer to home.

“We are deploying these complex agentic systems and models, with access to our most sensitive data and giving them the ability to take mission-critical actions on our behalf,” Nadella wrote in a personal blog post. “We simply can’t outsource responsibility for what intelligence does on our behalf. A model provider’s assurances do not relieve us of that responsibility… we need to separate the supply of intelligence from the authority over it.”

Microsoft’s security business chief, Hayete Gallot, was even more direct: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” Not because they are malicious, she argued, but because they are unpredictable — trained to achieve tasks, not to follow organizational norms or exercise judgment. And they are routinely handed the keys to the kingdom: access to data and tools that can do serious harm.

The new protections include agent detection in Microsoft Defender that can identify up to 60 types of agents employees bring into the workplace — including Claude Code, Codex and, notably, OpenClaw — plus dynamic permission controls that limit agents’ access to data and systems, and require human approval when an agent appears to be making risky decisions. It is a striking stance for a company that has invested billions in OpenAI and Anthropic; Microsoft is effectively telling its customers to treat its own partners’ products as potential insider threats. The logic, however, is sound: auditors should be independent of the organizations they audit, and agent monitoring should be independent of agent suppliers.

Nvidia and the Push for On-Device, Ownable Agents

While Microsoft plays security guard, Nvidia is attacking the same problem from a different angle: giving enterprises open models they can run, control and audit themselves. On the same news cycle, Nvidia launched the Nemotron 3.5 Super VL, a 120-billion-parameter open-weight model designed for always-on enterprise agents, alongside two lightweight Bolt models intended to run locally on PCs.

The positioning is explicit: “Unlike closed frontier models, organizations can post-train Super VL on their own data, deploy it on their own infrastructure and own what they build,” said Kari Briski, Nvidia’s vice president of open models and software. Nvidia claims Super VL completes agentic tasks faster than competing proprietary models — including Opus 5, GPT 6.1 Sol, Luna and Astra — when post-trained for tasks like document intelligence, financial accounting, scientific experimentation, medical insurance claims and security attack resilience. It has lined up heavyweight customers including Skydance, EY, Ramp, CrowdStrike, Perplexity and Salesforce to back the claim.

The smaller Bolt 74B-A9B model is designed to balance speed and reasoning for local agentic work — multi-step reasoning, tool calling, web browsing — without sending workloads to the cloud, while the smallest Bolt E4B targets conversational agents. It is Nvidia’s bet that privacy-conscious consumers and enterprises will prefer agents that run on hardware they own, inside perimeters they control, rather than inside a frontier lab’s data center.

Nvidia’s safety play rides alongside: the Open Agent Safety Platform, which Microsoft joined as an inaugural member, now has the backing of more than 100 companies. The platform isolates agents in secure environments and can monitor and halt their behavior at the hardware level — functioning, essentially, as a kill switch for rogue agents. The company’s German expansion is equally telling: as Chancellor Friedrich Merz urged German businesses to “open your doors for AI,” Nvidia announced new investments on the continent, betting that sovereignty — owning your models, your chips and your agents — is the winning narrative of the decade.

Geopolitics and the Compute Cold War

Meanwhile, governments are reacting to the same underlying anxiety with bans and blockades. The U.S. Department of Homeland Security has ordered all AI technology from Chinese firm DeepSeek removed from federal civilian systems, publishing a formal exclusion-and-removal order in the Federal Register that bars DeepSeek products from federal civilian agency procurements. The move, first reported Monday and confirmed by Reuters, CNBC and the BBC, is the clearest signal yet that Washington views Chinese AI infrastructure as a national security risk — not just for espionage, but for the systemic vulnerabilities that agentic attacks are now exploiting at scale.

The compute wars show no signs of cooling either:

Anthropic is reportedly in talks with Nscale for another $45 billion compute deal — the latest in a long string of giant infrastructure pacts that have become the AI lab’s defining financial strategy.
Amazon fired its biggest shot yet at Nvidia, releasing TorchNeuron, a developer tool designed to break Nvidia’s hold on PyTorch and push developers onto its own Trainium chips.
Tenstorrent, the Nvidia challenger, hit a $6.2 billion valuation after raising $1.5 billion to scale its open-weight AI chips, after drawing acquisition interest earlier this year.

Strip away the corporate maneuvering and the pattern is unmistakable: every major player is building toward a world where AI capability is distributed, ownable and defensible — because nobody trusts anyone else’s models, chips or agents anymore. Trust, in 2026, is the scarcest resource in technology.

What Defenders Must Do Now

NorForge’s report closes with practical guidance, and it is worth taking seriously even if your company was not on the victim list. The era of the agentic attacker changes the calculus of defense in three ways:

Patch the boring stuff first. The Cairn campaign did not rely on zero-days. It used SQL injection, unsafe file uploads, login bypasses, exposed admin panels and out-of-date frameworks like old Zend components. The basics of web hygiene — patching, input validation, secure deserialization and session store protection — are now the front line against autonomous attackers who patiently try every known weakness.
Assume agents are already inside. Microsoft’s “insider threat” framing applies to your own deployments: inventory every agent, code assistant and automation tool your employees use, monitor what they access, and require human approval for high-risk actions. If you cannot audit an agent’s behavior, do not give it credentials.
Hunt for webshells and unexpected files. The attackers’ goal was persistent access — uploader webshells planted for later use. Security teams should scan web directories for unexpected files, review suspicious requests, isolate compromised servers and investigate for stolen data and additional malware before restoring service. Assume the foothold is still there, waiting.

And a fourth, harder lesson: your incident response plan must now assume that attacks arrive in parallel, at machine speed, around the clock. Human defenders are no longer racing human attackers. They are racing software that never sleeps, never gets tired and gets cheaper every quarter.

The Verdict: The Barrier Has Fallen

There is a temptation to read the Cairn story as just another cybersecurity scare — a headline to worry about and forget. That would be a mistake. This is one of the first fully documented cases in which a single individual, with a few thousand dollars, outsourced a large-scale hacking campaign to autonomous AI agents and succeeded against more than a hundred organizations. The Gizmodo headline put it precisely: the fear of a “one-man-band” weaponizing AI agents is no longer hypothetical — it is reality.

The responses are already visible: Microsoft treating agents as untrustworthy insiders, Nvidia pushing owned-and-operated open models with hardware-level kill switches, Washington banning enemy AI from federal systems. But none of these measures reverse the fundamental shift. The capability that used to require a criminal enterprise — skilled operators, custom tooling, months of work — is now available as an open-source download and an API subscription. The cost of attempting to breach a company is now measured in single digits of dollars. The cost of successfully breaching one is roughly the price of a nice dinner.

Fagerland, who has watched this unfold from the front lines, put it best: the development in this field is astounding. For defenders, that is not a compliment. It is a countdown. The barrier to entry for cybercrime has fallen, and it is never going back up. Every company, from global manufacturers to the smallest online shop, is now defending against armies that cost less than their coffee budget — and that will not stop until the defenders’ toolkit changes just as radically as the attackers’ has.

— Vito Ruocco