An AI agent hacking campaign has broken into more than 100 company websites for roughly $50 per success, according to a security report published October 19. One Chinese-speaking attacker pointed cheap AI agents at about 1,200 sites and let them work. The lesson for you: attacks that once needed skilled people now cost the price of a lunch.
Here is the short version before the details.
- The campaign started September 25, 2026, and NorForge published its findings on October 19.
- Agents tried 1,200+ sites and got into 100+, a success rate of about 10%.
- Named victims include Deere, SharkNinja and Cummins.
- Estimated cost: about $5,000 in tokens, or roughly $50 per successful break-in.
The numbers matter because they show how little effort the attacker needed per target.
How the AI agent hacking campaign worked
NorForge researcher Snorre Fagerland found the activity while studying Cairn, an open-source platform where several AI agents share findings on a common board. A human sets the goal and can add hints. Cairn’s author says it was not built for hacking.
The attacker’s pipelines told agents to get code running on a target site and plant an uploader web shell, which is a simple form that accepts file uploads. That gives an attacker a quiet way back in. The apparent goal was lasting access to shop and payment systems, per The Next Web, which summarized the NorForge report and Reuters’ reporting.
In one case the agents found no flaw in a big company’s public app. So they found a linked control panel instead and spent hours of trial and error until its server ran their commands. Successful attacks took a little under 23 hours on average.
Who got hit, and what they said
Targets were mostly online shops in the US, Canada, Japan and Australia, with 200,000 to 1.5 million visits. Reuters matched victims by reviewing the attacker’s activity. It could not establish how much data, if any, was taken.
Here is what the three named companies have said so far.
| Company | What was hit | Company response |
|---|---|---|
| Deere | A company website (details not public) | Took remediation steps; saw no sign sensitive information was accessed |
| SharkNinja | A standalone product support site | Said the attack was contained |
| Cummins | A possible vendor website | Still investigating |
None of the three has confirmed stolen customer data. That could change as investigations finish.
Why $50 per break-in changes the math
A 10% success rate sounds low. At these prices it is a bargain for criminals, because failures cost almost nothing and run in parallel. NorForge puts the average at about $5 per task, including failed ones, though it admits the uncertainty is large.
NorForge noted the worker name claudecode_deepseek-v4.1-flash, which could mean Claude Code running DeepSeek’s low-cost V4.1 Flash model. That is an inference, not a confirmed fact. For background on the model, see our DeepSeek federal ban explainer.
The wider trend isn’t new. Our look at OpenAI rogue agent incidents shows agents can go off-script even for their makers. Here the agents did what a criminal told them.
The leak that exposed the operation
Cairn’s operators left their control panels open on the public internet. NorForge found them with internet scanning, starting around October 2. Inside were hundreds of exposed credentials and API keys, and 11% of those checked with Trufflehog were still valid.
The panels showed three groups of activity. A Chinese-language cluster ran 1,100+ attack projects across 14 panels. An English-language cluster told agents to steal credit cards and cryptocurrency. A third, smaller one is flagged malicious with low confidence.
The irony is hard to miss. The attackers made the same mistake they were hunting for: an admin panel facing the open web.
What shop owners and developers should check this week
The article gives no formal advice, so these steps are common-sense hardening, not NorForge guidance.
- Search your upload folders for files you didn’t put there, especially small scripts in image or media directories.
- Take admin and control panels off the public internet, or put them behind a VPN or IP allow-list.
- Rotate any API key that has ever sat in a public repo, log or dashboard. Our OpenCode breach guide covers how.
- Patch your shop software, plugins and any vendor-run support sites you link to.
Vendor sites matter because Cummins’ possible exposure came through one, and you rarely patch someone else’s server.
Frequently Asked Questions
Was my data stolen in the AI agent hacking campaign?
Unknown. Reuters could not establish how much data, if any, was taken. If you shop on a named company’s site, watch your card statements and reset reused passwords.
Which AI model did the attacker use?
NorForge says the worker name could point to Claude Code with DeepSeek V4.1 Flash. It has not confirmed that, and the Cairn author says the platform wasn’t meant for hacking.
Is it safe to run Cairn or similar agent tools?
Yes, if you keep control panels private and never leave keys in them. The leak here came from exposed panels, not from the idea of agent platforms.
How can I tell if my site has a web shell?
Look for unexpected files in upload directories and unusual outbound traffic. A file scanner from your host or a security plugin can help.
Our take: the boring fixes just got urgent
Don’t panic about “AI hackers” as a new species. This was ordinary web break-ins, done faster and cheaper. If you run a store, spend an hour this week on exposed admin panels, old upload files and stale keys. Those basics stop most of what agents try, and at $50 a try, attackers will keep trying.
Leave a Reply