One Operator’s AI Agents Breached 100+ Sites for About $50 Each 🚨

Posted on Oct 20 • Originally published at satirrdev.github.io • AI-assisted

Hey folks 👋 — this one is wild. On 19 October 2026, Snorre Fagerland of NorForge reported that a single Chinese-speaking operator used AI agents on the open-source Cairn platform to probe and breach websites. The operator wrote brief instructions (under 100 Chinese characters) and left nearly all the work to the agents. Reuters, which reviewed activity on exposed panels, identified more than 100 breached companies among more than 1,200 sites attempted. 🎯

The campaign started around 25 September 2026. Successful breaches averaged roughly 23 hours. NorForge estimated total token spend at about $5,000, or roughly $50 per successful breach, for an approximate 10% success rate. The worker identifier observed was claudecode_deepseek-v4.1-flash, which NorForge interprets as Claude Code calling DeepSeek V4.1 Flash. The stated goal was code execution followed by planting an uploader web shell for persistent access, primarily on e-commerce and payment-related sites in the US, Canada, Australia, and Japan. 💻

These are researcher estimates. Exact billing has not been publicly confirmed. The activity was observable largely because many panels were left exposed. ⚠️

The operator gave high-level goals and let the agents handle the rest: finding vulnerabilities, achieving code execution, and dropping an uploader web shell. Targets were ranked by traffic and tested with tools like Playwright before being fed to Cairn. The largest cluster (AIA0001) used Chinese language and spanned more than 1,100 projects across 14 panels. Fagerland found the activity by scanning for publicly exposed Cairn control panels and identified roughly two dozen malicious instances in early October.

Reuters named three victims after reviewing activity:

Reuters could not determine how much data, if any, was exfiltrated. 😬

This campaign is distinct from an earlier September 2026 Cairn-related operation reported by Forbes and Gambit Security that involved Hermes and credit-card theft. Cost figures are researcher estimates; exact billing has not been publicly confirmed. The activity was observable largely because many panels were left exposed — once operators close those panels, the visibility drops.

NorForge’s report and the Reuters coverage give a rare look at autonomous agent use at scale for intrusion. The low per-success cost and the hands-off operator model are the parts that stand out. Whether this becomes more common depends on how quickly defenders notice exposed control planes and how hard it is to keep agents from leaving traces.

$50 per successful breach is low enough that the economics change. Traditional targeted intrusion often involves more manual time, higher tooling costs, or lower success rates. Here the operator’s marginal cost is mostly tokens, and the agents can run in parallel across many targets. The ~10% success rate still means most attempts fail, but the absolute number of compromises (100+) is large enough to matter for the operator’s goals.

Fagerland’s estimate of ~$5,000 total is a researcher calculation based on observed activity and typical token pricing for the models involved. It is not an invoice. Different quantizations, caching, or provider discounts could move the number. The important signal is the order of magnitude: low thousands of dollars for a campaign that touched more than a hundred companies.

The visibility came from exposed Cairn control panels. Once those panels are firewalled or authenticated properly, the same activity becomes much harder to observe from the outside. Teams that run or host agent frameworks should treat the control plane as sensitive: network exposure, default credentials, and unauthenticated dashboards are the practical failure modes here.

On the target side, the agents were looking for code execution paths and then dropping an uploader web shell. Standard web-shell detection, file integrity monitoring, and outbound connection controls still apply. The novelty is the scale and the low human touch, not a brand-new vulnerability class.

The reporting so far does not answer those. What it does show is that the combination of a capable open agent platform, short high-level prompts, and inexpensive model calls is already sufficient for a single operator to generate triple-digit breaches at low per-success cost.

One operator, short prompts, open-source Cairn agents, ~$50 and ~23 hours per successful breach of 100+ companies. The numbers are estimates and the panels were exposed, but the pattern is clear enough that more teams are going to start looking for similar control-plane leaks.

Discussion question: Have you seen exposed agent control panels (Cairn or otherwise) in the wild, or are you already scanning for them? Drop what you’re seeing 👇