Breaking into a company website used to require a skilled person with a free week. According to a new threat report, it now requires about fifty dollars in API tokens and a patient agent that does not mind failing nine times out of ten.
Snorre Fagerland, a lead threat researcher at NorForge, says AI agents helped one operator compromise more than 100 company websites. The tool of choice was Cairn, an open platform that hands out tasks to AI agents and lets them swap findings on a shared board. The estimated average cost of a successful intrusion was around $50. Whether you find that number alarming or oddly cheap probably depends on what your own security budget looks like.
What the campaign looked like
Per NorForge, the activity began on 25 September 2026. The group behind it used 14 Cairn control panels and launched more than 1,100 attack projects. In total, the agents tried to attack over 1,200 sites.
The targets were online stores in the United States, Canada, Japan and Australia. The playbook was simple to describe:
- Pick a store. The agents chose e-commerce sites in the four countries above.
- Find a way to run code. They looked for a route to remote code execution on the server.
- Plant a web shell. If that worked, they installed a tool for uploading files, which can also give the attacker a way back in later.
Fagerland's reading is that the goal was to dig into the stores' systems and payment infrastructure for possible use down the line. That is his assessment of intent, not a documented outcome.
The $50 intrusion, and the fine print
The task logs NorForge examined referenced a component named 'claudecode_deepseek-v4.1-flash'. Fagerland suspects this means Anthropic's Claude Code paired with DeepSeek's inexpensive V4.1 Flash model. It is an inference from the label, not a confirmation from either company.
The numbers, as reported:
| Metric | Figure |
|---|---|
| Start of campaign | 25 September 2026 |
| Cairn control panels used | 14 |
| Attack projects launched | more than 1,100 |
| Sites targeted | more than 1,200 |
| Sites reportedly compromised | more than 100 |
| Average duration of a successful attack | just under 23 hours |
| Estimated token spend | about $5,000 |
| Estimated cost per successful intrusion | about $50 |
| Average success rate in the groups studied | about 10% |
The $50 figure deserves a caveat, and the researcher supplies it himself. It is a rough estimate. NorForge's report puts the average cost of a single job at about $5, counting failed and abandoned attempts. Spread roughly $5,000 of spend over a bit more than 100 wins and you land near $50. The arithmetic hangs together, but it is back-of-the-envelope, and Fagerland notes that the tasks varied from group to group.
The quiet insight sits in the 10% success rate. A human attacker who fails nine times in ten gets discouraged. An agent billed in tokens simply goes again, and the failures are priced into the average. Cheap models make that bargain work.
What the named companies said
A news agency that examined the attacker's activity found potential victims that included the farm equipment maker Deere, the appliance maker SharkNinja and the engine maker Cummins. The Next Web-style claim that every intrusion is verified does not hold. The full list of more than 100 breaches could not be independently confirmed.
The companies' own answers varied:
- Deere said it took steps to remove the threat and found no sign that sensitive data was accessed.
- SharkNinja said an individual technical support and localization site was attacked, and that the threat was contained.
- Cummins said it was looking into reports of a possible breach of a supplier's website.
Note what these statements are and are not. None says data was stolen, none says it was safe in every respect, and the reporting could not establish whether any data left the building. The honest summary is that the sites were touched, and the damage, if any, is unknown.
The operator left the door open
The most amusing detail is also a useful one. Several of the Cairn control panels were left reachable from the internet, and they held credentials, API keys and other secrets. The scanner Trufflehog confirmed that 11% of the secrets it found were valid.
So a campaign built around finding exposed systems on other people's servers was itself run from exposed systems. There is a certain symmetry there. The practical upshot is less comic, since leaked keys in those panels could point researchers, and anyone else who looked, toward further infrastructure.
Cairn's author said the platform was not built for hacking and that such use does not match his intentions. That is a familiar position for anyone who publishes an open tool, and it does not change how the tool behaved here.
What this does and does not prove
What is established, going by NorForge's data: a coordinated campaign ran at scale, used an agent orchestration platform, and ran on a cheap model stack at low cost per job.
What is still soft:
- The breach count. More than 100 is the researcher's figure, and not every case has been independently verified.
- The model pairing. It rests on a component name and Fagerland's interpretation of it.
- The intent. Long-term access to stores and payment systems is a hypothesis about what the attacker wanted.
- The damage. No one has shown what, if anything, was taken.
A sober to-do list
The source does not prescribe fixes, so the following is my own reading of the mechanics, not NorForge's advice. The campaign relied on two things: servers with exploitable code execution paths, and web shells that sit quietly once installed. Operators of online stores have reason to patch the former promptly and to hunt for the latter, especially on secondary properties like support and localization sites, which is exactly where SharkNinja reported trouble. And anyone running agent tooling of their own might take the lesson of the exposed panels: keep the control plane off the public internet.
The trade-off is dull but real. Defenders pay in attention and routine maintenance, while the attacker pays in tokens. At roughly $50 a win, the attacker is currently getting the better exchange rate.
The kicker
For years, security vendors warned that AI would make attackers faster. The more awkward finding is that it makes them cheaper, and apparently no more careful about their own passwords.