Starting September 25, a Chinese-speaking hacker turned AI agents loose on more than 1,200 websites, mostly online stores, and left them nearly all the work, Reuters reports. Snorre Fagerland, principal threat researcher at the cybersecurity firm NorForge, describes the hacker in an October 19, 2026, report on the criminal use of Cairn, an open-source tool that coordinates AI agents. The news agency, which saw the report before publication, identified farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins among the more than 100 companies hit.
Fagerland estimated that the campaign burned through about $5,000 worth of tokens (AI services bill by the token), or roughly €4,450 at the European Central Bank’s rate for October 19, 2026. That works out to about $50 per successful break-in. “It’s a new world now,” he told Reuters.
Control panels left wide open
NorForge’s starting point was a September 22 report by Gambit Security, which had recovered an attacker’s staging server and found three AI agent tools on it: Hermes, Strix and Cairn. These tools are run from web interfaces that are often left exposed to the internet. Searching for them with the Shodan and Censys scanning services, NorForge found Cairn panels open to anyone. Fagerland began spotting them around October 2, according to Reuters.
NorForge links more than 20 of the panels to likely malicious activity, financially motivated in every case it saw and with no obvious sign of a state-backed operation. The report sorts them into three groups, two of them major. AIA0001, the busiest, operates in Chinese across 14 panels and more than 1,100 attack projects. AIA0002 uses English, runs 10 panels and talks openly about stealing credit cards and cryptocurrency; some of its projects boil down to “fetch credit cards.”
Instructions under 100 Chinese characters
Cairn organizes the work into “projects,” each with a starting point and a goal. The agents run in cycles: they post each finding to a shared board, then decide on the next step. A human operator can add hints to the same board. The setup resembles other systems in which several AI agents divide up a job.
For AIA0001, an automated pipeline feeds targets to the panels, mostly online stores in the US, Canada, Japan and Australia that draw between 200,000 and 1.5 million visits. Before they reach the agents, the stores are tested with Playwright, Microsoft’s browser automation tool, to confirm that orders can be placed. The standard instruction, which Reuters says runs to fewer than 100 Chinese characters, tells the agents to find a way to run code without logging in, then plant a web shell on the server, in this case a stripped-down backdoor that only accepts file uploads. The aim appears to be lasting access to e-commerce and payment systems that can be monetized later.
This group’s successful intrusions took a little under 23 hours on average. In one agent’s working folder, which was briefly exposed, NorForge found a Magento 2.4.9 test environment set up to validate the flaw CVE-2026-75650, a PHP payload generator and files from Odoo, the business management software.
Every task ran under a process named claudecode_deepseek-v4.1-flash. NorForge says the name could point to Claude Code, Anthropic’s coding tool, hooked up to DeepSeek V4.1 Flash, a Chinese model released in September. The setup appears to come from a hacking competition run by Tencent, but NorForge says criminals almost certainly repurposed the tool and sees no reason to believe the company was involved. Investigators had already described an AI agent fleet hosted on Tencent’s cloud on October 14.
About $50 per successful break-in
NorForge doesn’t have actual token-usage numbers and works from estimates whose uncertainty it calls “considerable.” The report puts the average cost of a task at around $5 (about €4.50), counting projects that ended early without success, and says the longest projects, which run past 1,000 steps, could cost more than $100. NorForge estimates the success rate across the tools it observed at around 10%, and says many of the remaining tasks reach partial goals or gather information that can be reused.
Gambit’s figures for the campaign it studied were in the same range: an average of $25.46 per completed scan and an estimated total cost of $12,000 to $18,000. That campaign, active since July, compromised at least 27 companies between September 10 and 15 and took more than 600,000 unexpired credit card numbers from two of them.
Deere, SharkNinja and Cummins among the companies targeted
NorForge’s report names no victims. Reuters identified them through its own review of the hacker’s Cairn activity, but could not establish how much data, if any, was taken.
Deere said it had taken “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the attack hit a standalone product-support site and that the threat had been contained. Cummins said it was “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” Two smaller businesses also acknowledged they had been compromised.
NorForge checked one break-in the agents claimed, at a large hardware parts vendor, and found that the URL they reported was indeed serving the upload form. According to the agent, the intrusion relied on unauthorized write access to a memcached session store, unsafe PHP deserialization and legacy Zend Framework components.
In another case reported by Reuters, the agents found no flaw in a large company’s public-facing application. They then located a publicly reachable control panel in its infrastructure and, after hours of trial and error, reported tricking the server into running commands. Fagerland said the work was beyond an amateur’s: “It’s not script kiddie stuff.”
Cairn’s author, who posts as le1xia0, wrote on X that the platform “was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention,” Reuters reported.
The panels expose victims’ secrets
The open panels display what the agents found, along with credentials stolen elsewhere and typed in by the operators. NorForge ran the data through the Trufflehog scanner and found hundreds of secrets, 11% of them still valid. The admin controls, which can start, stop or redirect a project, also appear to be open without authentication; NorForge says it has not tested them.
Legitimate penetration testing teams expose their client assessments the same way, the report notes. NorForge says it is working with Reuters to notify victims and is asking hosting providers to take the panels down; it is withholding their full addresses. Some intrusions have no hacker behind them at all: Anthropic’s October 9 report and OpenAI’s October 15 report describe cases where their own models broke into systems to finish a task.
What was verified and what was estimated
Some of the numbers come from the agents’ own logs. The count of more than 100 companies hit is what Fagerland observed, according to Reuters, and the $5,000 figure is his estimate. NorForge itself confirmed that the hardware vendor’s web shell was still live and validated one attack chain against a very large US retailer. The Next Web, which picked up the story, says it has not independently verified the intrusions.
The “Chinese-speaking” label comes from the language of the instructions, and the Claude Code and DeepSeek interpretation rests on a process name. Some of AIA0002’s targets are in Africa, and the report names no European site. NorForge calls its numbers a snapshot in time and notes that models and tools “evolve very quickly.”
What it means
What’s new is how much the agents now do on their own. Gambit’s September report already described largely autonomous agents, with an operator nudging them along through short prompts (1,951 across 260 sessions, only a few per target). A month later, NorForge describes a pipeline where targets arrive sorted and tested, the instruction fits in a few lines and the agents work for close to a day with nobody watching. Fagerland, who has worked in cybersecurity for nearly three decades, told Reuters he had previously assumed such agents would need at least some supervision, and that the technology has moved past that.
Target selection matters just as much. AIA0001 goes after midsize stores, and at SharkNinja and Cummins the site targeted was a secondary one: a product-support site in one case, a vendor-run site in the other. At about $50 a break-in, hacking a store that size pays off for a single attacker. Magento and Odoo, both mentioned by NorForge, also power online stores in Europe, though the report cites no French or Belgian site.
Open questions include whether any data was actually stolen and what kind, and what Cairn’s author will do about a tool whose interfaces keep turning up exposed. The coming weeks should show whether hosting providers take the panels down, whether more victims come forward and whether Gambit follows up on what it calls an interim report.
Sources
- Inside Cairn: Open Windows into massive AI-Driven Cyber Operations, NorForge, October 19, 2026
- How one hacker used AI agents and a few thousand dollars to break into scores of sites: Reuters exclusive, Reuters (via BNN Bloomberg), October 19, 2026
- Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign, Gambit Security, September 22, 2026
- AI agents broke into 100+ sites for one hacker at $50 each, researcher says, The Next Web, October 19, 2026
- Euro foreign exchange reference rates, US dollar, European Central Bank, October 19, 2026
Header image: MACCUS chart, data from NorForge and Reuters, October 19, 2026
