Fifty dollars. That’s the estimated cost in AI tokens of each successful break-in in a campaign that hit more than 100 company websites. The attacker barely had to type.
According to technology.org, researcher Snorre Fagerland of NorForge found the operation because the criminals left their control dashboards open. The agents tried more than 1,200 sites in the US, Canada, Australia and Japan, and got into over 100. Fagerland puts the token bill near $5,000, with each successful intrusion taking about 23 hours.
What the researcher actually found
Fagerland was hunting for exposed copies of Cairn, an open-source tool that gives AI agents a goal and lets them work toward it step by step. Operators often leave its web interface unprotected. From around October 2, he found about two dozen panels in malicious use.
They showed targets, findings, stolen credentials and live progress. NorForge ties 14 of them to a Chinese-speaking operator it calls AIA0001, with more than 1,100 attack projects. The campaign started September 25.
Almost no human input
The instructions ran to fewer than 100 Chinese characters. An automated pipeline picked real shopping sites with 200,000 to 1.5 million visitors, and checked with Microsoft’s Playwright that orders could go through. The goal was remote code execution without logging in, typically by planting an upload shell as a standing back door. NorForge confirmed one such shell live on a hardware vendor’s site.
The worker name suggests Anthropic’s Claude Code harness driving DeepSeek’s V4.1 Flash model. Successful projects averaged about 140 findings. One ran for over five days.
Victims and unanswered questions
Journalists, not the report, named victims: Deere, SharkNinja and Cummins. Deere saw no sign sensitive data was accessed. SharkNinja said the site held product support information. Cummins said a third-party vendor’s site was involved. Two smaller businesses also confirmed compromises.
Notice the careful wording. Nobody has established how much data was taken. Companies saying they found “no indication” of access is not the same as proof that nothing left.
The cost figure also deserves a squint. NorForge’s own estimate averages about $5 per task across all attempts, failures included, and admits a wide margin of error.
The attackers were sloppy too
Those open panels leaked victims’ secrets. Running Trufflehog over the exposed data turned up hundreds of credentials and keys, 11% verified as valid. The dashboards appeared to expose admin controls, so a stranger could in theory redirect the agents. NorForge says it is helping notify victims and pushing hosting providers to pull the panels.
For users, this matters because the victims were shopping sites. Stored customer data and payment flows sit behind exactly the kind of web apps these agents probe. The standard advice still applies: patch exposed apps, rotate leaked keys, keep a breach plan ready.
Not a one-off
In September, Gambit Security described a campaign chaining Strix, Cairn and Hermes to compromise at least 27 organizations and copy over 600,000 payment card records, at about $25 a target. G7 finance leaders have agreed to run drills against AI-driven attacks. The pattern is clear: cheap, open tooling, rented models and little skill required. Defenders should assume the next operator locks the dashboard.