> ## Content Index > Fetch the complete content index at: https://debugly.dev/llms.txt > Use this file to discover other available public pages before exploring further. # AI Agents Breached 100 Companies for $5,000 - URL: https://debugly.dev/ai-agents-breached-100-companies-5000-dollars/ - Published: 2026-10-20T13:30:00.000Z - Updated: 2026-10-20T13:30:00.000Z - Description: A solo hacker used AI agents to breach 100+ sites for $5,000. Reuters traced the work through exposed Cairn dashboards. - Author: Rohit Bhadani - Tags: Security, AI A solo hacker used off the shelf AI agents to break into websites belonging to more than 100 companies for about $5,000 in token costs. The campaign started 25 September, tried more than 1,200 e-commerce sites in the United States, Canada, Australia and Japan, and averaged 23 hours per successful intrusion. A NorForge researcher watched the work happen through roughly two dozen exposed Cairn dashboards. The details here come from Reuters reporting published 19 October 2026, NorForge research by principal threat researcher Snorre Fagerland, and company responses from Deere, SharkNinja and Cummins reviewed by Reuters. ## What did the agents actually do? | Property | Detail | | ---------------------- | ------------------------------------------------------------------------------- | | Operator | Chinese speaking, fewer than 100 Chinese characters of instruction | | Platform | Cairn, open source AI problem solving platform, plus Playwright for pre checks | | Targets | 1,200+ e-commerce sites, US, Canada, Australia, Japan from 25 September | | Success | 100+ company websites breached, about 10 percent success rate | | Average intrusion time | 23 hours per success, one ran more than five days | | Estimated cost | About $5,000 total, about $50 per success, about $5 per task including failures | | Success method | SQL injection, unsafe file upload, login bypass, unsafe object deserialization | | Exposure | About two dozen Cairn deployments left openly accessible, found 2 October | Cairn is a general purpose agent coordinator. The operator gave it a target and a goal, such as find a way to run code without signing in, and the agents searched for weaknesses. A Playwright pipeline filtered the target list to stores that could actually accept orders. ## How did a 100 character prompt become a breach? The prompt described a preferred class of weakness, not a step by step exploit. The agents then spent hours probing. In one case they failed to find a weakness in the main public application, searched related infrastructure records, found an internet facing control panel, and eventually found a weakness in how that panel processed data. They spent hours trying alternatives and reported that they had made the server run attacker commands. That sequence surprised Fagerland. He told Reuters it is not straightforward to come up with solutions like that, and that he had expected hacking agents to need supervision. The agents appeared to use DeepSeek and Anthropic Claude Code, although NorForge did not confirm the full model mix. Worker names in the exposed dashboards suggested a Claude Code setup with a DeepSeek model behind it. I have run Cairn style harnesses in our lab at [Krova Cloud](https://krova.cloud/?ref=debugly.dev) where we isolate agent workloads in microVMs, and the pattern where an agent pivots from the main app to a related control panel is exactly what a bounded toolset encourages. If the main target resists, the agent widens the scope to whatever DNS or certificate data it can enumerate. The guardrail that stops that widening has to sit outside the agent. ## What did the breaches look like to the companies? Deere told Reuters it had taken remedial action and had no indication sensitive information was accessed. SharkNinja said the intrusion affected a standalone product support site with only product information and that the threat had been contained. Cummins said it was investigating a possible attack on a website operated by a third party vendor. Two smaller businesses also acknowledged compromise. The extent of data taken across the campaign remains unknown. NorForge confirmed one claimed breach technically. It checked an address the operator said it had breached on a hardware vendor site and found a live uploader webshell, a server side script that lets an attacker place files on the compromised site. According to the agent's own log, that attack combined an unauthorized write to a memcached session store with unsafe PHP object deserialization and older Zend Framework components. NorForge tracked the largest activity cluster as AIA0001, linked to 14 dashboards and more than 1,100 projects aimed at shopping and payment systems. ## How much did the automation actually cost? Fagerland estimated about $5,000 in tokens for the main campaign, roughly $50 per successful intrusion, and about $5 per task when failures and early ending attempts were counted. He warned uncertainty was substantial because the figures are estimates from observed usage, not billed invoices. The economics are the signal. A manual campaign of this breadth would have required a team. One operator supplied the target list and a short goal, and the agents handled almost all the work. The reported 10 percent success rate across more than 1,200 attempts is not high, but the cost per attempt is low enough to tolerate failure. I ran a single site probe in a harness limited to the target domain. It took just under two hours and consumed about $3.20 before I stopped it at the login bypass stage. At $5 per task, the operator could afford nine failures for each success. ## What does this change for defenders? The campaign shows that the bottleneck for broad opportunistic attacks is no longer human time. It is token budget and target list quality. The Playwright pre filter improved the hit rate by ensuring each target was a live shop before spending agent time on it. For defenders, the hardening is familiar: parameterized queries, safe file upload handling, no unsafe deserialization, and no exposed control panels. The difference is that those weaknesses now get tested at 23 hour persistence per target. According to Reuters, NorForge found hundreds of exposed secrets in the open panels and is working to notify victims. Unsecured testing dashboards also leaked customer information. An exposed agent dashboard is itself a breach. I treat any agent that can browse and write files as an untrusted user session. At [Krova Cloud](https://krova.cloud/?ref=debugly.dev) we run those workloads in disposable microVMs. ## What is the verdict and where does it fall short? According to NorForge, the exposed dashboards let Fagerland follow the agents starting 2 October, which means the campaign was visible to anyone who scanned for open Cairn deployments. According to Reuters, the reporting was cross checked against company responses and against a live webshell on one claimed target. The verdict is that agentic automation makes low skill breadth attacks viable. The operator did not write 1,200 exploits. He wrote a short goal and let agents iterate. The limitations are threefold. First, the $5,000 figure is an estimate with substantial uncertainty, not a billed total. Second, the reported 100+ successes are based on operator claims and spot checks, not a full forensic audit of all 1,200 targets. Reuters could not determine how much data, if any, was taken. Third, the prompt wording does not establish the operator's nationality or sponsorship. Researchers found no obvious state backed activity in the exposed panels. ### FAQ **Did the agents use zero days?** No evidence points to zero days. The classes are known: SQL injection, file upload, login bypass, and unsafe deserialization. **Does this affect only e-commerce?** The observed pipeline targeted shopping sites that could accept orders, but the same Cairn workflow could be pointed at any web application. The target choice was economic, not technical. **What should teams check this week?** Search logs for long running probes that iterate the same weaknesses for hours, and audit any internet facing control panels. This persistence pattern matches what I saw testing [agent credentials with least privilege](https://debugly.dev/agent-credentials-least-privilege/) and [prompt injection as an architectural problem](https://debugly.dev/prompt-injection-architectural-problem/). --- Published on [debugly.dev](https://debugly.dev/) by [Rohit Bhadani](https://debugly.dev/about/) | Founder of [Krova Cloud](https://krova.cloud/?ref=debugly.dev) --- Published on [debugly.dev](https://debugly.dev/) by [Rohit Bhadani](https://debugly.dev/about/) | Founder of [Krova Cloud](https://krova.cloud/?ref=debugly.dev)