AI agents hacking real companies is no longer a lab scenario. A single attacker used an open-source agent platform to break into the websites of more than 100 companies in under a month, at an estimated cost of about $50 per successful intrusion, according to research published on Monday by the Norwegian security firm NorForge and reported by Reuters.
The case is the clearest public example so far of an autonomous agent system being pointed at the open internet and left to work. It also lands at a moment when lawmakers, regulators and AI developers are still arguing about who is responsible when a general-purpose agent tool is turned into an attack kit.
What the researchers found
Snorre Fagerland, principal threat researcher at NorForge, began spotting exposed control panels for a platform called Cairn around October 2. Cairn takes a target and a goal, then has several AI agents work toward it step by step, sharing what they learn on a common board. A human operator can step in with hints.
Fagerland found more than 20 panels that were likely malicious. The largest group, which NorForge rated malicious with high confidence and which used Chinese-language instructions, covered more than 1,100 attack projects across 14 panels. The campaign began on September 25, according to the research.
The main points from NorForge and Reuters:
- The attacker's agents attempted intrusions on more than 1,200 sites by late last week.
- More than 100 companies had their websites breached, Reuters reported.
- Successful attacks took a little under 23 hours on average.
- Fagerland estimated total token spending at about $5,000, or roughly $50 per successful hack. NorForge's report puts the average at about $5 per task, including failures, and says the uncertainty in both figures is considerable.
- Typical targets were online shops in the US, Canada, Japan and Australia. The agents tried to run code on each site and plant a web shell that would keep access to shop and payment systems.
Reuters identified Deere, SharkNinja and Cummins among the targets by reviewing the attacker's Cairn activity. Deere said it took remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and was contained. Cummins said it was investigating a possible attack on a website run by one of its vendors. Reuters could not determine how much data, if any, was taken.
How little the human did
The attacker's instructions were short, often under 100 Chinese characters, according to Reuters. In one case, after the agents failed to find a weakness in a large company's public application, they went looking for related infrastructure, found a public-facing control panel, and spent hours of trial and error exploiting a subtle data-processing flaw until they could run commands on the server.
"It's not script kiddie stuff," Fagerland told Reuters. "The development in this field is astounding."
All tasks in the main cluster ran on a worker labelled "claudecode_deepseek-v4.1-flash", which NorForge says could mean Anthropic's Claude Code harness running DeepSeek's low-cost V4.1 Flash model. That detail has not been confirmed by either company.
Why AI agents hacking cheaply is a policy problem
Three features of this case matter for governance more than the headline numbers.
The tool is general-purpose. Cairn's author, who posts as le1xia0, wrote on X that the project is a multi-agent architecture not designed for hacking: "If it is used to carry out harmful hacking attacks, that is not my intention." That is the classic dual-use defence, and it is the same argument open-weight model developers make. Current rules in the US and EU mostly place obligations on model providers, not on the authors of open-source orchestration layers that sit on top of them.
The cost floor has dropped. A break-in that costs tens of dollars in tokens changes the economics for criminals. It makes broad, opportunistic campaigns against small and mid-sized businesses worthwhile, and those are the firms least able to detect a web shell on a support site.
The attackers were careless, and that is how they were caught. NorForge found the campaign because the operators left their control panels exposed. Those panels also leaked hundreds of credentials and API keys, 11% of which the open-source tool Trufflehog verified as valid. Some legitimate security firms exposed client work the same way. A more careful operator would have been far harder to see.
A pattern, not a one-off
This is not the first such case this autumn. TNW notes that a September report from Gambit Security found Cairn on an attacker's server in a case where AI agents stole at least 600,000 credit card records from 25 companies. Taiwan's government said earlier this year that AI agents helped hackers breach its systems, and India's cyber agency has said agents under testing broke into firms' live systems.
Banks are already reacting at the edges. Earlier on Monday we reported that Schwab and JPMorgan have blocked outside AI agents from moving customer money, a defensive step that treats any third-party agent as untrusted by default.
What happens next
No government response to the NorForge findings has been reported so far. NorForge says it is working with Reuters to warn victims and is asking hosting providers to take down the exposed panels.
For policymakers, the open questions are concrete:
- Should providers of agent harnesses and coding agents be required to detect and block sustained intrusion workflows, as some model providers already try to do?
- Should hosting providers face clearer duties to remove exposed attack infrastructure once reported?
- How should incident reporting rules treat breaches carried out mostly by software agents, where the human role is a two-line instruction?
For companies, the practical lesson is narrower. Forgotten support sites, vendor-run pages and exposed admin panels are exactly what an agent with time and a token budget will find. Attack surface that a human attacker would skip as not worth the effort is now worth $50.
