AI agents enable $5,000 breach of over 100 company websites

Key Takeaways

• A single, Chinese-speaking hacker utilized AI agents to breach over 100 company websites.
• The estimated cost for this extensive campaign was approximately $5,000 in AI tokens.
• Major corporations like Deere, SharkNinja, and Cummins were among the targets, though the impact varied.
• The attacks exploited common web vulnerabilities such as SQL injection, unsafe file uploads, and login bypasses, aiming for persistent access to financial systems.
• Mitigation requires patching public-facing applications, securing admin panels, and monitoring for suspicious web activity.

A sophisticated cyber campaign involving AI agents successfully breached more than 100 corporate websites with an estimated expenditure of just $5,000 on AI tokens. This operation, detailed in an October investigation by Reuters, highlights a new paradigm where a single individual can orchestrate complex, wide-ranging attacks with minimal direct human intervention.

The targets of this campaign included online properties associated with major companies such as Deere, SharkNinja, and Cummins. While the full extent of the impact on each entity is still being assessed, the attacks, which commenced on September 25, ultimately attempted to compromise over 1,200 websites. The primary focus was on e-commerce platforms located in the United States, Canada, Australia, and Japan.

The malicious activity came to light through the efforts of Snorre Fagerland, a principal threat researcher at NorForge. Fagerland’s investigation into exposed installations of Cairn, an open-source platform designed for coordinating AI agents, led to the discovery of approximately two dozen instances being actively used for nefarious purposes around October 2.

Automating Attacks with Cairn

Cairn, fundamentally a general-purpose problem-solving engine, was repurposed by the attackers for hacking. As outlined in NorForge’s technical report, operators would define a target and a specific objective. The AI agents would then autonomously probe for weaknesses and systematically work towards gaining unauthorized access.

A key feature of Cairn is its ability to store findings on a shared project board. This allows individual agents to leverage prior discoveries, dynamically adjusting their approach when initial methods fail. This iterative process provides a significant advantage over rigid, single-path scanning tools.

NorForge meticulously tracked the most prominent Chinese-language activity cluster, designated AIA0001. This cluster was linked to 14 dashboards managing over 1,100 attack projects. The attackers’ target selection pipeline integrated Microsoft’s Playwright browser automation tool to first verify that potential shopping sites could process orders before feeding them into the Cairn system.

The operational directives given to the agents primarily focused on identifying methods to execute code without requiring authentication. This encompassed a range of vulnerabilities, including SQL injection, unsafe file uploads, login bypasses, and insecure handling of stored objects. The overarching goal appeared to be the establishment of persistent access to shopping and payment systems, which could later be monetized.

NorForge validated one claimed breach by examining a reported address on a hardware vendor’s website. They discovered a live uploader webshell, a server-side script enabling the placement of arbitrary files on the compromised site, thereby establishing a critical foothold for subsequent attacks.

According to the agent’s own logs, this particular attack involved a complex chain: unauthorized write access to a memcached session store, combined with unsafe PHP object deserialization and vulnerabilities in older Zend Framework components. This sequence effectively transformed weaknesses in session management and object processing into direct server access, rather than relying on a single, easily identifiable entry point.

In another notable instance, the AI agents demonstrated their adaptability. After failing to locate a vulnerability within a company’s primary application, they shifted focus to related infrastructure. There, they uncovered an exposed control panel and spent several hours systematically testing its data handling mechanisms, ultimately reporting the ability to execute commands on the server.

Low Costs, Persistent Agents

The successful projects within the AIA0001 cluster averaged just under 23 hours to complete, with one particularly persistent agent operating for over five days. Across all observed campaigns, NorForge estimated a success rate of approximately 10%, though the specific objectives and targets varied among the operators.

Fagerland estimated that the primary campaign consumed roughly $5,000 in AI tokens, translating to an approximate cost of $50 per successful intrusion. It is important to note that these figures are estimates and not confirmed billing records. NorForge also calculated the average task cost, including failed and prematurely terminated attempts, to be around $5, acknowledging a substantial degree of uncertainty in these calculations.

While worker names suggested a Claude Code setup utilizing a DeepSeek model, NorForge could not definitively confirm the full model configuration used. The presence of Chinese-language instructions does not conclusively determine the operator’s nationality, and researchers found no clear evidence of state-sponsored activity within the exposed panels.

Other reports on AI agents highlight similar threats, including a separate campaign involving Cairn and other tools used for stealing retail credit card data. Another investigation into DeepSeek-powered credential theft revealed attackers leveraging agents to exploit exposed secrets and misconfigured settings, rather than zero-day vulnerabilities.

Deere told Reuters that it implemented corrective actions and found no indication of sensitive information compromise. SharkNinja confirmed that the affected system was a distinct product support site and that the threat had been contained. Cummins is currently investigating a potential attack on a website managed by a third party.

Reuters was unable to ascertain the volume or nature of data, if any, exfiltrated across these breaches. NorForge also discovered hundreds of exposed secrets within the open panels and is collaborating with Reuters to notify affected victims.

The exposure of these AI tools also impacted legitimate security testers. NorForge identified unsecured testing dashboards containing customer information, underscoring how poorly protected AI tools can inadvertently introduce risks even during authorized security work.

What You Should Do

• Patch Public-Facing Applications: Ensure all web applications, especially those accessible from the internet, are fully updated with the latest security patches.
• Restrict Admin Panel Access: Implement strict access controls for administrative interfaces, ideally limiting access to specific IP addresses or VPN connections.
• Monitor Web Directories: Regularly check web server directories for unexpected or unauthorized files, which could indicate a webshell or other compromise.
• Review Suspicious Web Requests: Implement robust logging and monitoring to detect unusual web requests, such as attempts to access non-existent pages or unusual parameters.
• Isolate Compromised Servers: If a webshell or compromise is detected, immediately isolate the affected server from the network to prevent further lateral movement.
• Forensic Investigation: Conduct a thorough forensic investigation to determine the extent of the breach, identify stolen data, discover any further access points, and detect additional malware before restoring service.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.