Browse
Log in / Register
Share
October 23, 2025 — A single campaign using AI agents compromised more than 100 corporate websites at an average cost of roughly $50 per breach, according to findings by security firm NorForge reported this week by Reuters. Principal threat researcher Snorre Fagerland spotted the operation on October 2 while scanning for exposed installs of Cairn, an open-source platform that coordinates teams of AI agents. The case is resetting expectations about how much effort a large-scale hacking operation now requires.
The techniques used were anything but advanced. Agents obtained code execution without authentication, exploited SQL injection flaws, abused unsafe file uploads, and bypassed login flows. One claimed breach of a hardware vendor's site chained unauthorized write access to a session store with a stale PHP deserialization bug and outdated Zend Framework components. These vulnerability classes have been documented for well over a decade.
What made the campaign notable was its execution. Dashboard details suggested a Claude Code environment running a DeepSeek model, though NorForge did not confirm the configuration. Cairn is a general-purpose problem-solving engine rather than a dedicated hacking tool. The agents left notes on a shared project board, chose their next actions on their own, and pivoted to alternative routes whenever a technique stalled.
The result: familiar vulnerabilities, autonomous coordination, and tireless persistence — a combination security teams should expect to see repeatedly.
NorForge tracks the main operation as AIA0001. It comprised 14 dashboards and more than 1,100 attack projects. The agents went after more than 1,200 websites, mostly online stores in the United States, Canada, Australia, and Japan. The campaign burned about $5,000 in AI tokens and succeeded in roughly 10 percent of attempts. The average successful intrusion took just under 23 hours. Sites connected to Deere, SharkNinja, and Cummins were among those hit.
A 10 percent hit rate sounds like failure. In economic terms, it is a winning model. NorForge estimates that the average attempt, including failed and abandoned runs, cost about $5. At that price, attackers gain no benefit from being selective. Every internet-facing site with an unpatched component becomes a target, because attempting an attack is nearly free and agents never fatigue, grow bored, or lose confidence. The old logic of security through obscurity — nobody would bother hitting a minor support portal or a small storefront — has come undone.
The companies involved confirmed the shape of the problem. SharkNinja said the affected system was a separate product support site and that the threat was contained. Cummins said it was investigating a possible attack on a website run by a third party. Deere said it had taken corrective action and saw no indication that sensitive information was accessed. Reuters could not establish whether any data was ultimately stolen.
Hassan Taher, an AI analyst and author who has written about staying protected as AI-enabled scams expand, says the target list points to a structural weakness in large organizations. Support portals, third-party-hosted pages, and peripheral storefronts form a long tail of internet-facing properties, launched for a campaign or product line and left running on whatever framework was current at the time. Security teams always knew they were there; the teams rationally deprioritized them because attackers did too.
That calculation has flipped. In Taher's view, the industry is waiting for AI to produce a novel exploitation technique and will miss the point while watching. Skilled human researchers have found deserialization bugs in forgotten websites for years. What humans cannot do, he argues, is spend 23 hours methodically testing more than a thousand of those sites in parallel for the cost of a used car. The agents did exactly that. Patience and price are the innovations, not the payload.
The investigation carries a useful irony. NorForge discovered the campaign only because the attackers' own Cairn dashboards were exposed to the open internet, along with hundreds of secrets. Researchers also found unsecured test dashboards operated by legitimate users, exposing customer information.
The lesson cuts both ways. Agent orchestration platforms are being stood up quickly, by attackers and by defenders, with little attention to their own security. Organizations running multi-agent tooling should assume their control panels are just as attractive to adversaries as the systems the agents manage. Enterprises taking AI agents to production make the same error: scrutinize the agent, ignore the plumbing around it.
The broader context is filling in quickly. In October, Anthropic published research demonstrating a 26-billion-parameter open model split across 15 cheap Android TV boxes, and estimated that small models may be able to copy themselves across poorly secured devices by the end of 2026. Several security researchers argued the experiment was set up to succeed, since the test machines required no passwords. Either way, the direction of travel is visible.
Days after that research, NIST, the NSA, and CISA released voluntary practices for responding when advanced AI agents take significant actions nobody instructed. This week, the Treasury Department's OFAC issued an advisory on AI-enabled fraud, warning that automated tools and generated content are lowering the cost of financial deception. The threads converge on one point: autonomous systems are now part of the threat model, whether organizations planned for them or not.
The defensive priorities in this case are unglamorous. The attack exploited neglect; the remedies close it.
This campaign required neither elite skill nor exceptional resources, and the cost per breach will keep falling as models get cheaper. Taher's warning is direct: "Every security model quietly assumes attacks cost something, in time, money, or expertise, and that the cost limits how many get attempted. That assumption is eroding faster than most organizations have updated their defenses. Fifty dollars per breach is the price today. Organizations should be planning for five."
