Cairn AI Agents Breached 100+ Sites at ~$50 Each

The attacker’s instructions ran to fewer than 100 Chinese characters. That’s about the length of a long text message, and it was enough to point a swarm of AI agents at more than 1,200 online shops in the US, Canada, Japan and Australia.

The security firm NorForge published the details on October 19 in a report called “Inside Cairn.” Reuters, which saw it before release, reported that the attacker got into the websites of more than 100 companies and named three: farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins.

How NorForge saw any of this

Cairn is an open-source tool that coordinates AI agents toward a goal. You give it a start point and an end condition. Each agent writes what it finds onto a shared board that every other agent can read, and a human can add hints. NorForge says it was built as a general problem-solving engine, not a hacking kit, and its author wrote on X that harmful use “is not my intention.”

One mistake mattered. Many of them left their Cairn dashboards open on the public web, where anyone scanning for them could look in. NorForge’s researcher, Snorre Fagerland, started finding them around October 2 and counted more than 20 panels he judged likely malicious. Because the dashboards show every task, every finding and sometimes passwords, he could read the campaign as it happened.

The busiest group, which NorForge labels AIA0001, had more than 1,100 attack projects across 14 panels. Its typical task told the agents to find a way to run code on a shop with 200,000 to 1.5 million visitors, then leave behind a small uploader script as a way back in. NorForge checked one claimed break-in at a large hardware parts vendor and found the uploader live.

The $50 figure

Here’s where the headlines run ahead of the report. Reuters and The Next Web both carry Fagerland’s estimate of roughly $5,000 in AI usage fees, or about $50 per successful break-in. NorForge’s own write-up is more careful. It puts the average at about $5 per task, counting the many that failed or stopped early, and says some long-running tasks could top $100. It also says “the uncertainty is considerable.” There are no token logs behind any of it, only a guess built from how long the projects ran.

Other numbers in the report are firmer. A successful intrusion took a little under 23 hours. Across the tools NorForge tracked, the success rate was about 10 percent. So roughly nine in ten attempts went nowhere, and the attacker didn’t care, because failed attempts cost almost nothing.

That ratio is the part I’d take seriously. Nobody needs a clever agent if a cheap one can retry all night.

Which models

Every task in the main cluster ran under a worker named claudecode_deepseek-v4.1-flash. NorForge says that “could mean” Anthropic’s Claude Code tool driving DeepSeek’s low-cost V4.1 Flash model. That’s a reading of a label, not proof. Neither company has commented in anything I could find. A second, English-language group used a worker name that suggests a different coding agent calling DeepSeek through OpenRouter.

If you want the model side of this, DeepSeek’s October 17 update is the release in question, and it’s MIT-licensed, so nobody can switch it off. We also covered a different open model and what it did on cyber tasks. The pattern across both is the same: the capability is cheap and available, and the defenders can’t recall it.

What the victims said

Reuters reported that Deere took “necessary remediation actions” and has no indication sensitive information was accessed. SharkNinja said the attack reached a separate site holding only product support information and that the threat is contained. Cummins said it is looking into a possible attack on a website run by an outside supplier. So the named cases look limited. For now. NorForge also says it is working with Reuters to warn victims, and that the exposed panels leaked hundreds of credentials and keys, of which 11 percent checked out as valid.

What I think

One reading is that a one-person crew can now run an intrusion factory for the price of a used laptop. The other is that the crew was sloppy enough to publish its own control room, the break-ins mostly planted a foothold rather than stealing anything yet, and the real cost per success is unknown.

I lean toward the first anyway. The attackers didn’t need the agents to be good. Their pipeline tested target shops with a browser tool first, fed them in automatically and let the agents grind. NorForge even noticed a bug that stripped the first “w” from some domains, so “winter” became “inter.” That’s a sloppy operation and it still got through 100 companies.

Nobody knows how many careful attackers run the same setup behind a password.

One hacker's AI agents broke into 100+ company sites at about $50 a break-in. The $50 comes with an asterisk.