The AI Agent Hacking Campaign Cost $50 Per Breach, Researcher Says

Fast Facts

The AI agent hacking campaign reported by Reuters used an open-source agent platform called Cairn to target more than 1,200 websites and reportedly breach over 100, including sites tied to Deere (NYSE: DE), SharkNinja (NYSE: SN) and Cummins (NYSE: CMI). NorForge researcher Snorre Fagerland estimates about $5,000 in tokens, roughly $50 per successful breach.

The numbers are estimates, the intrusions are not independently verified, and the model behind the agents is unconfirmed. The signal is still clear: attackers now pay by the token, and a failed attempt costs them about the price of a coffee.

Breaching a hundred company websites used to imply a team, a budget and weeks of work. The AI agent hacking campaign that NorForge documented suggests one operator and an automated pipeline can do it with short instructions. NorForge published its report on Monday, October 19, and Reuters identified victims from the hacker’s activity.

How the AI Agent Hacking Campaign Worked

Cairn is an open-source platform where a user sets a target and a goal, and AI agents work toward it step by step, posting findings to a shared board all agents can read. Its author, posting as le1xia0, said on X that Cairn was not designed for hacking. NorForge tracked the campaign from September 25 and began finding exposed control panels around October 2.

Per NorForge, a pipeline fed tasks to agents, telling each to find a way to run code on a site and then plant an uploader web shell. Reported weakness classes included SQL injection, unsafe file uploads, login bypass and unsafe object handling. When one public application had no flaw, the agents found a linked control panel and, after hours of trial and error, made its server run commands. Successful attacks averaged just under 23 hours.

100+ breached | 1,200+ targeted | ~$50 per success

Estimates from NorForge via Reuters and The Next Web. Success rate was roughly 10%, and NorForge says the cost uncertainty is considerable. Data theft is unconfirmed.

Why the Economics Matter More Than the Exploits

NorForge puts the average at about $5 per task once failures are counted, against about $50 per success. That spread is the point. At a 10% hit rate, an operator can lose nine attempts and still come out ahead.

“It’s not script kiddie stuff.”
— Snorre Fagerland, NorForge, to Reuters

Worker names in the pipeline read “claudecode_deepseek-v4.1-flash,” which NorForge says could mean Claude Code running DeepSeek’s low-cost model. That is a possibility, not a finding. The cost angle echoes a market we have already examined. See our analysis where we explain why discounted AI API access is a data leak with a coupon code, because cheap tokens are what make a $5 attempt rational.

This is also not the first case of agents doing offensive work. See our analysis where we explain how AI-automated cyber espionage by Chinese hackers unfolded. The new element is cost and scale, not novelty.

What the Exposed Panels Revealed

Many operators in the AI agent hacking campaign left their Cairn dashboards open. NorForge saw hundreds of credentials and API keys leaked from targets, and Trufflehog verified 11% of the exposed secrets as valid.

Agent platforms are attack surface too. See our analysis where we explain why the Manus AI agent hijack shows guardrails detect but cannot stop. Earlier incidents show the pattern spreading. Gambit Security reported in September that agents stole at least 600,000 card records from 25 companies, per The Next Web, and India’s CERT-In recently said agents under testing reached live systems at Indian organizations, per TechCrunch. See our analysis where we explain why AI cybercrime in Africa just crossed a dangerous 55% threshold.

What Buyers and Defenders Should Do Now

The named victims suggest where the weak points sit. SharkNinja said only a standalone product support site was hit, and Cummins is investigating a possible attack on a site run by one of its vendors. Deere took remediation steps and saw no sign that sensitive information was accessed. The side site and the vendor site are the soft targets in an AI agent hacking campaign.

NorForge’s advice is practical: patch public-facing applications, restrict admin panels, watch web directories for unexpected files, and isolate servers where web shells appear. Microsoft also announced agent-detection controls on October 19, including Defender detection of up to 60 agent types, per TechCrunch. Defending against agents you do not own is a different job from governing agents you do. See our analysis where we explain the five costly AI agent security blind spots no one is fixing.

⚠️ Hypothetical scenario: A Lagos fashion retailer runs checkout on a plugin-heavy store, plus a forgotten promo microsite an agency built two years ago. An agent finds the microsite’s admin panel, plants an upload shell and waits. Nobody notices for weeks, because the microsite has no owner. The lesson from this kind of AI agent hacking campaign is to inventory what you forgot.

💡 CreedTec Analyst’s Note by Daniel Ikechukwu

Strategic Impact

This AI agent hacking campaign moves the risk from skill to cost. Patch backlogs that attackers once ignored are now worth a $5 attempt. Small and mid-size firms in emerging markets, often running older web stacks, sit in the cheapest part of that price curve.

Stop / Start / Watch

Stop: assuming obscure side sites and vendor-run pages are too small to be targeted.
Start: inventorying every public site, lock admin panels behind access controls, and alert on new files in web directories.
Watch: whether NorForge’s victim count is independently confirmed and whether hosts take the exposed panels down.

ROI Outlook

Defense spend is easiest to justify against an attacker whose marginal cost is about $5. Patching and access control cost less than an incident response retainer. The $50 figure is an estimate and should not be quoted as a precise price.

— Daniel Ikechukwu