AI Agents Breached 100-Plus Company Sites for $5,000

A single hacker used AI agents to break into more than 100 company websites while spending an estimated five thousand dollars on the model's token fees, according to a Reuters investigation published this week. Researchers at the security firm NorForge uncovered the campaign. The operator wrote instructions in under one hundred Chinese characters, and the software handled nearly everything after that.

The targets included websites connected to the farm equipment maker Deere, the appliance company SharkNinja, and the engine manufacturer Cummins, Reuters reported. The attacks reached the United States, Canada, Australia, and Japan. Starting on September 25, the bots attempted more than 1,200 websites, most of them online stores.

How the attack worked

The campaign ran on Cairn, an open-source platform that coordinates teams of agent software to solve problems. Here the problem was breaking into websites. NorForge principal threat researcher Snorre Fagerland found the operation while scanning the internet for exposed Cairn dashboards. Around October 2, he came across roughly two dozen installations being used for attacks.

According to NorForge's technical report, the bots followed a simple loop: pick a target, probe it for weaknesses, and try a new angle when one approach failed. Findings went onto a shared project board so later attempts could build on what earlier ones had learned. A Microsoft browser-automation tool was used first to check that a shopping site could accept orders before it was passed to the agents.

The instructions told the software to find ways to run code on a site without logging in, using known techniques such as SQL injection, unsafe file uploads, and login bypasses. The apparent goal was lasting access to shopping and payment systems that could be monetized later, the researchers said.

NorForge confirmed at least one claimed breach: a live uploader webshell planted on a hardware vendor's website. Per the agent's own account, that break-in chained unauthorized write access to a memcached session store with unsafe PHP object deserialization and outdated Zend Framework components. In another case, the bots gave up on a company's main application, searched its surrounding infrastructure, found an exposed control panel, and spent hours testing it before reporting they could run commands on the server.

The worker names on the dashboards suggested a setup pairing Anthropic's Claude Code harness with a DeepSeek V4.1 Flash model, though NorForge treated that reading as an inference rather than a confirmed fact. The Chinese-language instructions do not establish the operator's nationality, and the researchers found no sign of state-backed activity, according to Cyber Security News, which reviewed the report.

Cheaper, slower, and harder to stop

The economics set this case apart. Successful break-ins took just under 23 hours on average, while a single project ran for more than five days. NorForge put the campaign's success rate at about ten percent, and estimated the operator's total token bill at roughly the figure named above, or about fifty dollars per successful intrusion. Counting failed and abandoned attempts, the average task cost about $5 per attempt. Fagerland stressed these were estimates, not confirmed billing records.

The operator's briefing was shorter than a text message. After that, the agents worked largely unsupervised. "It's not script kiddie stuff," Fagerland told Reuters, a sign that experienced defenders are taking automated intrusions seriously.

The named victims responded differently. Deere told Reuters it had taken corrective action and found no indication that attackers accessed sensitive information. SharkNinja said the affected system was a separate product support site and that the threat had been contained. Cummins said it was investigating a possible attack on a third-party-run website. Reuters reported it could not determine how much data, if any, was taken, and NorForge said it was working with the news agency to notify victims.

The exposure cut the other way too. NorForge found that some exposed dashboards belonged to legitimate security testers, and that poorly secured tooling had leaked customer information from authorized work. The open panels also held hundreds of exposed secrets, according to the researchers.

What defenders should do

For security teams, the researchers' advice is practical: patch public-facing applications, lock down admin panels, and watch for unexpected files appearing in web directories. They also recommend reviewing suspicious web requests and isolating any server where a webshell turns up before restoring service.

Microsoft has begun selling risk scoring for agents as part of its Microsoft 365 E7 tier, with Guardian Agents meant to investigate and contain risky ones, according to trade-press coverage of the launch. The NorForge findings suggest defenders should now assume attackers can run patient, adaptive break-in attempts for the price of a dinner.

Cyber Security News published a full breakdown of the NorForge research on October 20, and AI Weekly carried additional detail on the campaign's economics and tooling. Both drew on the original Reuters investigation.