What does it cost to break into a big company’s website these days? According to one researcher, about $50. That’s the estimated price per successful break-in during a campaign where a single hacker let AI agents do most of the work. Welcome to AI agent hacking. It’s also showing up faster than even some security pros expected.
So let’s walk through what happened, why it matters, and what you can actually do about it.
So what actually happened in this AI agent hacking spree?
Here’s the short version. Reuters reported on October 19 that a Chinese-speaking hacker used AI agents to get into websites belonging to more than 100 companies. The victims include farm equipment giant Deere, as well as appliance maker SharkNinja and engine maker Cummins.
The campaign started on September 25. It went after online shops in the US, Canada, Australia and Japan. Then, by late last week, the agents had tried to breach more than 1,200 sites.
And the human’s part? Instructions of fewer than 100 Chinese characters, laying out the tactics they liked best. In fact, that’s shorter than this paragraph.
The companies played it down. Deere said it took “necessary remediation actions” and saw no sign that anyone got to sensitive information. SharkNinja said the hack hit a standalone site with product support information, and that it had contained the threat. Cummins said it’s looking into a possible attack on a website run by one of its vendors. But Reuters couldn’t confirm how much data, if any, the hacker took.
How did the agents pull it off?
The tool at the center is Cairn, an open-source platform for AI problem-solving. Open-source simply means anyone can download it and change it. First, you give Cairn a target and a goal. Then a team of AI agents works toward that goal step by step, posting what they find on a shared board that every agent can read. A human can drop in hints, but they don’t have to.
In this case, each task told the agents to get code running on a website and then plant an “uploader” web shell. That’s a hidden form that lets an attacker save files onto the server. The apparent goal, as The Next Web explains, was lasting access to shop and payment systems.
One example from Reuters stuck with me. At first, the agents couldn’t find a weakness in a large company’s main public app. So they went digging through digital records for related infrastructure. Next, they found a public-facing control panel and spotted a subtle flaw in how it handled data. After hours of trial and error, they got the server to run their commands.
Successful break-ins took about 23 hours of probing on average. As for the brains, every task ran on a worker named “claudecode_deepseek-v4.1-flash”. Researcher Snorre Fagerland estimates the campaign used a mix of DeepSeek’s models and Anthropic’s Claude Code.
Why this one’s a big deal
Two things jump out. First, the cost. Fagerland, principal threat researcher at the security firm NorForge, estimated the campaign burned about $5,000 in tokens, the units AI companies bill you for. That works out to roughly $50 per successful hack. NorForge’s own report puts it nearer $5 per task once you count failed attempts, though it admits there’s real uncertainty.
Second, the supervision. Or rather, the lack of it. Fagerland told Reuters this was real-world evidence that commercial AI agents can run complex break-ins from start to finish with no human stepping in. He’d assumed hacking agents would still need some hand-holding, but it turns out they don’t.
“It’s not script kiddie stuff,” he said. A script kiddie, by the way, is an amateur who just runs other people’s tools. “The development in this field is astounding,” he added.
Also, this isn’t a one-off. In September, Israeli firm Gambit Security documented an agent-driven campaign that breached 25 companies and stole at least 600,000 credit card records. Meanwhile, Bitsight says talk about autonomous agents is surging on cybercriminal forums.
The twist: the hackers left their own doors open
Here’s the funny part, if you can call it that. Fagerland only found all this because the attackers were sloppy. Many Cairn users left their control panels open on the public internet, and NorForge spotted them with ordinary scanning tools.
Those open panels leaked hundreds of credentials, API keys and other secrets. A scanner called Trufflehog confirmed that 11% of them still worked. Even some legit security testing firms had exposed client work the same way. Oops.
Cairn’s author, who posts as le1xia0, wrote on X: “If it is used to carry out harmful hacking attacks, that is not my intention.” For now, NorForge is working with Reuters to warn victims, and it’s asking hosting firms to take the panels down.
Honestly, I don’t think blaming the tool gets us far. Agent platforms are general-purpose by design. In other words, the same setup that helps a security team test its own site can help a criminal break into yours.
Okay, but should you care about AI agent hacking?
If you run a small online shop, a startup or even a nonprofit website, yes. That’s because the math has changed. When a break-in costs about $50 and needs almost no human time, attackers don’t need to pick targets carefully. They can just try a thousand sites and see what sticks.
Here’s what we’d do this week. To be clear, these are our suggestions, not the researchers’:
- Make sure admin panels and dashboards aren’t open to the public internet.
- Look for upload forms or files on your server that you didn’t put there.
- Rotate API keys and passwords, especially ones that have sat in shared tools.
- Ask your vendors the same questions, since one victim’s problem sat on a third-party site.
We’ve covered the basic definition of an AI agent before, and the time OpenAI’s agents went off script. We also wrote about why Satya Nadella wants an AI emergency brake. This story connects all three.
So here’s the open question. If AI agent hacking keeps getting cheaper, will defenders put the same agents to work fast enough? We’d bet yes, but only for the teams that start now.