AI Agents Broke Into More Than 100 Companies' Websites, at About $50 a Successful Hack

The operator wrote out the tactics in fewer than 100 Chinese characters. From there, AI agents running on an open source penetration testing tool worked out where each online shop was weak, chained the steps together and planted upload forms, largely unsupervised. By the time a researcher found the control panels sitting on the open internet, the agents had attempted more than 1,200 sites, and the whole campaign had cost about $5,000 in tokens. The uncomfortable lesson for IT leaders is not that AI discovered a new class of vulnerability. It found old ones, at a price that makes every forgotten storefront worth attacking.

A Pentest Tool, Pointed at Shops Without Permission

NorForge researcher Snorre Fagerland published his findings on October 19 after scanning the internet for exposed copies of Cairn, an open source tool built for authorized penetration testing. Cairn gives AI agents a starting point and a goal, has them work toward it step by step, and posts their findings to a shared board where a human operator can add hints. Starting around October 2, Fagerland found exposed instances that let him watch the attackers' work in real time. NorForge grouped the panels it judged likely malicious into three clusters totaling 25, and excluded panels that appeared to belong to legitimate red teams or demos.

The busiest cluster, which NorForge tracks as AIA0001, was Chinese-language and linked 14 panels to more than 1,100 attack projects. Its tasks told agents to find unauthenticated remote code execution on sites with between 200,000 and 1.5 million in traffic, then plant an uploader shell rather than a command-executing web shell. It even used Playwright to confirm that a target would accept an order before exploitation began. NorForge assessed the goal as persistent access to e-commerce and payment infrastructure for later monetization, with targets mainly in the US, Japan and Australia. A second, English-language cluster went after cards and crypto, and NorForge saw no obvious sign of state sponsorship.

Reuters, which reviewed the attacker's records, reported that the agents attempted more than 1,200 sites and reached sites of more than 100 companies, according to The Hacker News. Deere said it took steps to fix the problem and found no sign sensitive information was accessed. SharkNinja said the attack hit a standalone product-support site and was contained. Cummins said it was investigating a report of a possible attack on a website run by one of its vendors. How much data, if any, left these sites is unknown.

Old Bugs, Machine Patience and Small Bills

None of the documented intrusions needed a novel exploit. One chain combined unauthorized write access to a memcached session store, unsafe handling of saved PHP objects and a weakness in old Zend Framework code. At one very large US retailer, which NorForge confirmed independently, the agents found a single cookie setting that selected a vulnerable backend server. NorForge also checked one claimed break-in at a large hardware-parts vendor and found the web shell still live. These are flaws that sit in legacy code for years because no human tester ever has the time to look.

The agents had the time. Successful AIA0001 tasks took a little under 23 hours from start to goal and averaged 140 recorded facts per project, and one project ran for more than five days. NorForge puts the success rate at around 10% and the average cost at about $5 per task, including attempts that failed or ended early, while stressing that the uncertainty is considerable. Fagerland told Reuters the campaign used about $5,000 in tokens, roughly $50 for each successful hack.

Those economics are not a one-off. Gambit Security's September report on a separate campaign, which used Cairn alongside the Hermes and Strix harnesses, put the cost at about $25 per company, a mean of $25.46 across 101 completed scans. Between September 10 and 15 that operator launched 105 attack projects and compromised at least 27 companies, and access usually took under a day. More than 600,000 unexpired credit card records were taken from two victims, and skimmers were confirmed on 19 sites. At a bicycle retailer, an agent's cleanup routine dropped 180 tables, including backups the victim's own administrators had made. No source links the two operations.

The Attackers Left Their Own Doors Open

The campaign was visible only because its infrastructure was as careless as its targets. NorForge ran the Trufflehog secrets scanner on the panel data and found hundreds of secrets, 11% of them verified as still valid. The panels also exposed controls for starting and stopping projects and redirecting agents to new targets, although NorForge did not test whether those controls worked without a login. Some legitimate penetration testing firms had left real client tests on unsecured panels too, exposing their customers' data. "The attackers are not well prepared for this technology either," NorForge wrote. Neither, it turns out, are some of the defenders using the same tools.

• Inventory every public web property, including vendor-run ones. SharkNinja's exposure was a standalone support site and Cummins is looking at a vendor's site, so the attack surface is wider than the main storefront and the systems you host yourself.
• Hunt for stray upload forms. Unexpected file-upload forms in hidden directories were the foothold these agents planted, so scan web roots for new uploader scripts and alert on unexpected file writes on public servers.
• Retire or isolate legacy frameworks. Old Zend Framework code, unsafe PHP object handling and a writable session store were enough. Patch Adobe Commerce and Magento as well: a proof of concept for the critical StyleSmuggler flaw sat in one worker directory, though there is no evidence it was used.
• Detect patient automation, not just fast attacks. Agents spending close to a day on a single target and placing test orders through a real browser look like customers to rate limits, so watch for behavior patterns across sessions rather than volume alone.
• Lock down your own agent tooling. Panels of this kind often answer on port 8000 with no login. If your red team or a testing vendor runs Cairn or something like it, require authentication and keep client results off internet-facing dashboards.
• Plan for exploitation within hours. Gambit cites a16z data showing roughly 87% of exploited flaws were attacked on or before the day they became public, so define the minimum systems that keep revenue flowing and prove they can be restored under attack conditions.

For years, the long tail of neglected web properties was protected mostly by attacker economics: a regional support site or an old shop running legacy PHP was rarely worth a skilled person's week. Cairn's operators showed that a model, a goal and about a day of compute now cover that week for the price of a lunch. Every site an organization still exposes to the internet needs to be defended as if someone is already testing it, because at $50 a break-in, someone probably is.