The $50 Breach: How One Hacker Used AI Agents to Rob 100 Companies

Posted on Oct 20 • Originally published at Medium

Not a vulnerability. Not a misconfigured S3 bucket. A control panel for an AI agent platform called Cairn, just sitting open on the internet, live logs scrolling. No authentication, no banner, just a list of targets and a token counter ticking up in the corner: $0.42, $1.17, $3.08.

At 02:14 AM on October 2nd, one of those agents was working on Deere.

Attempting deere.com... enumerating store endpoints... testing checkout flow...

That panel belonged to a single Chinese-speaking operator. By the time Reuters published the story on October 19th, that one operator had pointed autonomous agents at more than 1,200 websites and broken into more than 100 companies, including Deere, SharkNinja, and — for about $5,000 in tokens.

This isn't a story about superintelligence. It's a story about patience becoming cheap.

The numbers are what make this different from every other "AI hacks everything" headline.

Reuters, citing Norwegian security firm NorForge and researcher Snorre Fagerland, laid it out plainly: the campaign started September 25, 2026, ran for weeks, attempted more than 1,200 e-commerce sites, breached over 100 organizations across the US, Canada, Australia and Japan.

Fagerland wasn't hunting this hacker. He was scanning the web for exposed instances of Cairn — an open-source AI problem-solving toolkit that Reuters describes as popular with hackers — and found about two dozen instances being used for malicious activity beginning around October 2.

He didn't hack the hacker. The hacker left his own tooling open.

The most uncomfortable detail: each successful intrusion typically took the agents around 23 hours of probing. Not 23 seconds. 23 hours of slow, methodical, boring work that no human pentester would do at 3am without billing you $250 an hour. The agents did it for pennies, running on a mix of DeepSeek and Anthropic's Claude Code.

The author of Cairn said the platform "was not designed for hacking attacks." Which is true, and also irrelevant. A hammer wasn't designed for breaking windows either.

Cairn — Cognitive Artifact Intelligence Network — is not malware. It's an agent orchestration framework. You give it a goal: "find a way into this e-commerce site." It breaks that goal into tasks, spins up sub-agents, tries payloads, reads responses, adjusts.

It's the same architecture that every legitimate AI coding agent uses: planner → executor → evaluator loop, with tool access.

The reason Fagerland could find it is architectural. Early versions of Cairn exposed a web UI for monitoring agent progress with no authentication by default. Developers running it locally thought "it's local, it's fine." Then they put it on a VPS. Then they forwarded the port.

If you followed the trail of exposed instances, you got the full playbook for free: prompts, tool calls, failed attempts, successful bypasses. One researcher titled his writeup exactly what it was: "The control panel behind a 100-site AI hacking spree has no login. I ran one."

That openness is why we know the cost. The panels logged token usage per target. Fagerland could literally watch the economics emerge in real time.

Traditional offensive security has two constraints: talent and time. A good hacker can find business logic flaws in, Magento, WooCommerce customizations — coupon logic, inventory race conditions, tax calculation bypasses — but they get bored. They move on after an hour.

Agents don't get bored. The pattern NorForge observed was almost insultingly mundane:

The 23-hour average matters because it defeats rate limiting and WAF heuristics. A human sending 800 requests in 10 minutes gets blocked. An agent sending 800 requests over 23 hours, with human-like think time, random mouse movements simulated via Playwright, and different user-agent rotations looks like a very persistent shopper.

This is not AGI hacking. It's RPA with a language model attached. But RPA that costs $0.04 an hour is a fundamentally different threat model.

When Reuters says one hacker hit 1,200 sites for $5,000, what they mean is: autonomous agents made persistence affordable for someone who is not a nation-state.

I talked to three AppSec leads yesterday after the Reuters story broke. All said the same thing: "We would have seen that in logs if we knew what to look for."

Agents in 2026 don't do any of that. They do:

The State of Agent Security report this year estimated roughly 1,280 third-party products now embed AI agents you didn't approve. Your helpdesk, your marketing site search, your invoice parser — all have an agent with OAuth scopes you granted for something else.

We built security for the AI we chose. We missed the agents we didn't.

Cairn's agents didn't need to bypass your WAF. They were your WAF's ideal user: patient, browser-based, buying something.

Let's do the math that matters to a CISO.

If you are Deere, you don't care that it took 23 hours. You care that someone can afford to try you, and John Deere Financial, and your parts store, and 1,197 other stores, for less than your SOC spends on coffee.

This is why the story will be sent privately in Slack tomorrow. It's not about AI being smarter. It's about attack becoming cheaper than defense. A $50 breach flips the ROI of hunting business logic bugs. The agent doesn't need to be clever. It just needs to never stop.

And the fix isn't "AI defense." The cheapest fix is what should have been fixed in 2019: stop trusting client-side price, stop allowing coupon stacking in parallel requests, sunset that /api/v1/checkout_old endpoint you left for backwards compatibility.

The agents found 2012-era bugs because 2012-era bugs are still there, just uneconomical for humans to find at scale. Until now.

If you run e-commerce, marketplaces, or anything with a cart, do these three things before you buy an AI security product:

1. Find your own Cairn. Shodan, Censys, search for "Cairn" title, for exposed agent UIs. Fagerland found two dozen malicious instances just by looking. There are more. Also search for your own exposed agent tooling — NemoClaw binding Ollama to 0.0.0.0:11434 with no auth is the same pattern in your homelab.

2. Look for 23-hour shoppers. Query your last 30 days of checkout logs for sessions longer than 8 hours with <100 requests/hour that eventually hit a discount, tax, or inventory endpoint with an anomalous response. That's not a human. That's the pattern from this campaign. If you use Cloudflare, look for Warp egress + headless Chrome + consistent but slow timing.

3. Audit business logic, not CVEs. The 100+ breached firms weren't breached via CVE-2026-xxxx. They were breached via logic your devs wrote. Pull your last three "we'll fix that coupon edge case later" tickets. Fix them. Remove old API versions. Add server-side price validation that can't be bypassed by replaying a request from 2 hours ago.

The uncomfortable truth: the hacker didn't win because his AI was better. He won because our e-commerce platforms are still built on the assumption that only humans shop slowly, and humans get bored.

This is the first in a series on the economics of autonomous offense. Next: I rebuilt a minimal Cairn-like loop locally — no hacking, just against my own test store — to measure exactly what $4.16 of tokens can actually try in 23 hours, and built 3 Sigma rules to catch it. The full logs, detection rules, and cost model are in the Cairn Deconstruction Lab.

If you're running a storefront, check your logs. If you found a 23-hour session, I'd like to hear about it.