One Operator's AI Agents Hit 1,200 Sites and Breached 100+ Companies. The Cost Was About $50 Per Success.

A Chinese-speaking operator pointed autonomous AI agents at more than 1,200 online shops and websites in the US, Canada, Australia and Japan, and compromised over 100 companies, according to NorForge researcher Snorre Fagerland, whose findings were reported via Reuters. The affected names include Deere, SharkNinja and Cummins. The tool was Cairn, an open-source agent framework built for authorized penetration testing. The researchers found it because the operator left the control panels exposed.

What the agents actually did

Per The Hacker News and The Next Web:

• The operator’s instructions were under 100 Chinese characters. Agents post findings to a shared board, and the operator can add hints.
• A typical goal was code execution plus planting a web-shell uploader.
• One documented chain combined write access to a memcached session store, unsafe PHP object handling and an old Zend Framework weakness. Nothing exotic.
• Successful intrusions averaged just under 23 hours.

The numbers that matter

Roughly 10% of attempts succeeded. Total token spend was about $5,000, which works out to around $50 per successful breach, or $4-5 per attempt. Coverage has quoted both “$5,000” and “$50” as headlines; they measure different things (total versus per success), per the BigGo Finance writeup.

A 10% hit rate and a 23-hour dwell time is not superhuman. The skeptic’s reading is fair: this is not novel capability. It is cost and scale. At $50 per breach, targets that were never worth a human attacker’s afternoon, like a product-support site or a vendor portal, become worth attacking. That is exactly what the victims describe. Deere says it fixed the issue and saw no sign of sensitive data access. SharkNinja says the affected site was a standalone product-support site and was contained. Cummins says it is investigating a vendor site.

The operator’s own opsec was sloppy too: exposed panels on an unauthenticated port, and hundreds of leaked secrets (11% verified valid, per the coverage).

What isn’t confirmed

One worker was named “claudecode_deepseek-v4.1-flash,” which hints at DeepSeek V4.1 Flash driven through Claude Code. Neither NorForge nor Reuters confirmed that, and we are not treating it as established. Cairn’s author told Reuters the tool wasn’t designed for attacks. So the question of who is responsible, the open-source tool author, the model provider, or the operator, has no settled answer here.

The tension

The defender’s view is that patch hygiene and exposed-panel scanning matter more now, because the floor on attack cost just dropped. The dual-use view is harder: restricting open-source offensive-agent tooling hurts the authorized pentesters it was built for, and restricting frontier-model providers only helps if the model that powered this was identified, which it wasn’t.

What we’re watching

We build agentic systems on Claude, so usage-policy enforcement on agentic cyber misuse is not abstract for us. We’re watching whether model providers take action against this kind of operator, whether the exposed panels get taken down, whether more victims disclose, and whether regulators start treating agent governance as a requirement rather than a feature.