One Hacker, 1,200 Attempts, $50 a Breach: Agentic Intrusion Gets Cheap

TL;DR

NorForge reported on 19 October a Chinese-speaking operator who delegated nearly everything to AI agents: 1,200+ intrusion attempts in three weeks, 100+ successes (Source : The Next Web — AI agents broke into 100+ sites for one hacker at $50 each).
Roughly $5,000 of tokens bought the campaign — about $50 per successful hack, $5 per task, at a 10% success rate.
Every job ran on a worker named claudecode_deepseek-v4.1-flash: most plausibly a Claude Code harness around a cheap DeepSeek model.
The goal was persistence, not theft: uploader web shells on shops with 200,000–1.5M visitors.
The attacker’s weak point was his own infrastructure — 20+ Cairn control panels left open and found by ordinary scanning.

The breach count is not the interesting number

A hundred compromised companies sounds sophisticated. What Reuters and NorForge actually describe is one person writing goals while a swarm of cheap agents grinds through targets unattended (Source : Reuters — How one hacker used AI agents and a few thousand dollars to break into scores of sites).

Reuters identified some victims from the operator’s own traffic: Deere, SharkNinja and Cummins. All three said impact looked contained, pointing to standalone or vendor-run sites rather than core systems.

The tool was Cairn, an open-source multi-agent platform. Its design matters: an operator gives a target and a goal, agents work step by step, each posts findings to a shared board the others read, and the human drops occasional hints. That coordination layer is what turns a mediocre model call into a search process that runs all night.

What ran

NorForge sorted the activity into three clusters after finding open Cairn panels from 2 October; the campaign began 25 September. The busiest, Chinese-language cluster is assessed malicious with high confidence: 1,100+ attack projects across 14 panels, aimed at shops in the US, Canada, Japan and Australia carrying 200,000 to 1.5 million visits, ordered to gain code execution and plant an uploader web shell. NorForge verified one claimed break-in at a hardware parts vendor where the shell was still live.

A second, English-language cluster of 10 panels targeted card and crypto theft; a third, one panel with 59 projects, is only weakly linked. Reported average success rate: about 10%.

The most instructive detail is a failure. When agents found nothing exploitable in a large company’s public app, they combed its linked infrastructure, found a control panel and, after hours of trial and error, talked its server into running commands. “It’s not script kiddie stuff,” NorForge’s Snorre Fagerland told Reuters. It is not genius either — it is patience at machine scale.

The arithmetic that changes the threat model

Fifteen hundred dollars a week of inference, 1,200 attempts, 100 wins: about $5 per attempt, $50 per success, 57 attempts a day, with roughly 23 hours of unattended work per successful break.

That is the shift. The old constraint on a campaign was human attention: one target at a time, every dead end billed in hours of a salary. When an attempt costs single-digit dollars and the loop runs overnight, the rational strategy inverts — stop selecting targets, spray the internet, let the 10% that land pay for the 90% that do not. A $50 shell on a storefront that processes payments needs no high hit rate to be profitable. Caveat both ways: NorForge calls the cost estimate rough, and Reuters could not establish how much data, if any, was taken.

The harness carries the capability

The worker name is the most policy-relevant line in the report: claudecode_deepseek-v4.1-flash most plausibly means Anthropic’s Claude Code harness driving DeepSeek’s low-cost Flash model. If so, the campaign did not run on the best model available — it ran on scaffolding: a task loop, a shared scratchpad, sub-agents, a human nudging.

That is the thesis behind Google’s Harness 2.0 work and Alibaba’s OpenGCUA computer-use harness, and it muddies accountability. Cairn’s author, posting as le1xia0, said the platform “was not designed for hacking attacks” and that “if it is used to carry out harmful hacking attacks, that is not my intention.” Platform author, harness vendor, model vendor and operator are four parties. The pattern is already documented: a September Gambit Security report tied Cairn to the theft of 600,000+ card records from 25 companies, and India’s CERT-In formalised AI agents as an attack surface in advisory CIAD-2026-0049.

Your agent control plane is the new open port

The campaign was caught because it was sloppy, not subtle. Operators left Cairn dashboards reachable from the public internet, and NorForge found them with scanners anyone can run. Those panels leaked a second time: scanning surfaced hundreds of credentials and API keys, 11% of which Trufflehog verified as valid. Some legitimate pentest firms had exposed client work the same way. An orchestration panel is the 2026 equivalent of an exposed Jenkins box — it holds goals, targets, credentials and logs in one place.

What defenders can change:

Detect volume, not payload. 1,200 probes against similarly sized storefronts is a pattern above any single request.
Hunt uploader shells. An agent optimising for persistence takes the lowest-barrier objective: a file-save form. Watch new writable directories.
Inventory control planes you and your vendors run. Cummins’ exposure arrived through a vendor’s site.
Rotate anything that touched an agent panel. 11% valid is not a rounding error.
Do not rely on prompt guardrails. Containment has to be network-level: default-deny egress, scoped credentials, no ambient authority.

FAQ

Did the agents steal data? Reuters could not establish how much, if any. The assessed objective was durable access; the verified artefact was a live uploader shell.

Is Cairn a hacking tool? No. It is a multi-agent problem solver whose shared-board design suits legitimate research. Its author says it was not built for attacks.

Do you need a frontier model? Nothing suggests it. The worker ran a low-cost Flash-tier model inside a coding harness.

How much should I trust the $50 figure? As an order of magnitude, not a price list. The robust part is the direction: tens of dollars, not thousands.