On October 19, Reuters reported that a single Chinese-speaking hacker spent roughly $5,000 on AI tokens to breach more than 100 companies, mostly e-commerce sites in the US, Canada, Australia, and Japan. No crew. No nation-state budget. Just one operator, a handful of AI agents, and instructions in Chinese shorter than a tweet.

This isn’t the first time this site has covered an AI agent going somewhere it wasn’t supposed to — OpenAI’s own misalignment disclosures have been a running feature all year, and Anthropic has flagged state-sponsored groups weaponizing Claude for cyberattacks. What’s different here is the actor. This wasn’t Moscow or Beijing. It was one person, working alone, who figured out that renting intelligence by the token is now cheaper than hiring a crew.

Quick Summary: What Happened

Detail	Info
Disclosed	October 19, 2026, by Reuters, based on research from NorForge
Scale	1,200+ sites targeted, 100+ companies breached (roughly a 10% success rate)
Cost	~$5,000 in total AI token spend, about $50 per successful breach
Tools used	The open-source Cairn agent platform, running Anthropic’s Claude Code agent framework pointed at DeepSeek’s models
Human input	Under 100 Chinese characters of instructions; agents then worked autonomously for an average of 23 hours per successful breach
How it was caught	Security researcher Snorre Fagerland of NorForge found the hacker’s Cairn control panels left exposed on the open internet
Named targets	Deere, SharkNinja, and Cummins, among others

Bottom line: A lone hacker turned autonomous AI agents loose on 1,200+ company websites for hours at a stretch, breached over 100 of them at the price of a dinner out per hack, and got caught only because he left his own dashboard logged in to the internet.

What Actually Happened

Start with the arithmetic, because it’s the part that should unsettle anyone running a security budget: $50 per successful breach. Not $50,000. Not $5 million for a zero-day. Fifty dollars in API tokens, spent on agents that mostly ran themselves.

According to Fagerland’s report, “Inside Cairn,” published alongside Reuters’ story, the campaign began around September 25, 2026. Over the following weeks, a single operator pointed autonomous agents at more than 1,200 company websites, concentrated on e-commerce operations in the US, Canada, Australia, and Japan. Roughly 1 in 10 attempts succeeded — which sounds modest until you remember that “succeeded” means a working foothold inside a company’s infrastructure, and the hacker only needed to pay for the attempts that actually worked.

The toolchain was Cairn, an open-source agent-orchestration platform built around a “state-space search” model — point it at a target and an objective, and it coordinates workers that probe, test, and exploit without a human steering each step. Fagerland’s exposed logs showed worker names tagged claudecode_deepseek-v4.1-flash, which is about as plain as attribution gets: the attacker ran Anthropic’s Claude Code as the agent harness, but wired it to call DeepSeek’s V4.1 Flash model underneath instead of Claude’s own. Claude Code is built to work with whatever model you point it at. Nothing stopped this hacker from pointing it at China’s cheapest capable option instead.

How Did the Hacker’s AI Agents Breach 100+ Companies?

1. Picked a target list. The operator fed the agents a batch of e-commerce URLs, mostly mid-size and large companies in the US, Canada, Australia, and Japan.
2. Issued a one-line instruction. Fewer than 100 Chinese characters — reportedly something close to “find a way to run code on each site, then plant a web shell.” No exploit code, no step-by-step playbook.
3. Let the agents probe autonomously. Cairn’s workers scanned each target for weaknesses, tested entry points, and attempted exploitation without the operator reviewing individual steps.
4. Chained reconnaissance into exploitation. Successful runs moved from finding a flaw to actually using it — an average of 23 hours of continuous, unsupervised agent work per breach that stuck.
5. Planted persistence. On compromised sites, the agents installed uploader web shells, giving the operator a way back in without repeating the whole process.
6. Moved to the next target. Across 1,200+ attempts, the agents repeated the cycle, succeeding on more than 100 — all for about $50 in tokens per win.

That’s not a jailbreak and it’s not a novel exploit chain. It’s a hacker who decided the AI could do the boring, time-consuming parts of a break-in — the parts that usually require either a skilled team or a lot of patience — and then just let it run.

Why This Matters

The number that should actually worry security teams isn’t 100+ breaches. It’s $50. Traditional intrusion campaigns at this scale required infrastructure, specialists for reconnaissance, specialists for exploitation, and time measured in person-weeks. This one required an account with an AI provider, a cheap model, and a platform that’s free to download. The barrier to running a four-country, 1,200-target campaign dropped to something close to zero marginal cost per attempt, because the “labor” is an agent that doesn’t need to sleep, get paid, or get bored.

This also lines up with what Microsoft has been documenting all year. Its 2026 Digital Defense Report found that AI has compressed attacker timelines to under 24 hours in many cases — and 23 hours per successful breach here fits that pattern almost exactly. The agents in this campaign weren’t fast because of some exotic capability. They were fast because nobody had to stop and think between steps.

The other detail worth sitting with: this operator got caught by accident. Fagerland didn’t crack any encryption or trace any payment. He found the hacker’s own Cairn control panels sitting exposed on the open internet, logged in, showing live operations. “About two dozen” exposed instances tied to malicious activity turned up in his scan, not just this one operator’s. The campaign that breached 100+ companies wasn’t undone by better defenses at those companies — it was undone by the attacker’s own operational security being worse than the defenses he was breaking through. That’s a genuinely unsettling thing to rely on as a detection strategy, because the next operator who locks down his own dashboard doesn’t make the same mistake.

Named victims give some shape to the real-world stakes. Deere said it took remediation steps and found no indication sensitive data was accessed. SharkNinja said the intrusion hit a standalone product-support site and has been contained. Cummins said it’s investigating a potential attack on a site run by a third-party vendor. None of the three has disclosed a major data loss — which, if anything, underscores how this campaign was optimized for volume and speed over depth. A $50 breach doesn’t need to be a sophisticated one to still be a breach.

What Are Your Options Now

If you run an e-commerce site or any public-facing company website, treat this as confirmation that “we’re too small to be a target” stopped being true the moment attackers stopped paying for human time. The economics that used to protect smaller companies — it’s not worth a hacker’s time to go after a mid-size retailer’s support site — don’t hold when the “time” is an agent’s, not a person’s. Basic hygiene matters more now, not less: patch known vulnerabilities, monitor for unusual outbound connections, and don’t assume obscurity is a defense.

If your team uses agent-orchestration platforms like Cairn for legitimate security testing, this is a reminder that the exposed-dashboard failure cuts both ways. The same control panel that let this hacker steer his agents is exactly the kind of interface that leaks operational details if left open to the internet — lock down access to any pentesting or agent-orchestration tooling the same way you’d lock down a production admin panel, because apparently actual criminals don’t bother.

If you’re assessing vendor risk around AI tooling generally, this campaign is a data point for why model-agnostic agent frameworks deserve scrutiny independent of which AI lab built them. Claude Code didn’t do anything wrong here in the sense of violating its own provider’s policies — DeepSeek’s model was doing the reasoning. The risk lives in the framework’s flexibility, not in any one company’s model. Our guide to AI safety for business covers the governance questions worth asking before letting any agent framework operate with real-world access.

The Bigger Picture

Zoom out and this fits a trend that’s been building all year: the gap between “AI-assisted attack” and “AI-run attack” keeps narrowing. Anthropic’s own September threat intelligence report documented Russian and Chinese state-linked groups running near-autonomous cyber operations with Claude. This campaign shows the same pattern doesn’t require a state budget — it requires a model cheap enough to run for 23 hours at a stretch and a platform that chains the steps together without a human in the loop. DeepSeek’s pricing has made “cheap enough” essentially a non-issue.

It’s also a reminder that supply-chain and tooling exposure keeps being the thing that actually gets caught, not the sophistication of the attack itself. This site covered the LiteLLM breach earlier this year, where a compromised dependency cascaded into thousands of exposed AI tool stacks. The common thread across both stories: the AI model is rarely the weak point. The infrastructure wrapped around it — a scanner, a control panel, a gateway left open — is.

Our Take

We think the headline number everyone’s going to repeat — “100+ companies, $5,000” — undersells the actual lesson here. The real story isn’t that AI agents are now cheap enough to run a hacking campaign. We already knew that was coming. It’s that the only reason anyone knows about this one is that the hacker was sloppy with his own tooling. Fagerland didn’t out-hack the attacker. He found an unlocked door the attacker didn’t know was unlocked.

That should scare defenders more than the breach count does. A $50-per-hit economics problem doesn’t go away because one operator got caught. It means the next one, running the same playbook with better operational security, might rack up the same 100+ breaches and never show up in anyone’s report. Cheap autonomous agents didn’t just lower the cost of attacking. They lowered the skill floor for doing it badly enough to still succeed — and that’s a much harder problem to patch than any single vulnerability.

Frequently Asked Questions

How much did the hacking campaign actually cost?

Roughly $5,000 in total AI token spend across the full campaign, which breaks down to about $50 per successful breach once you count the roughly 100+ companies compromised out of 1,200+ targeted sites.

What AI tools were used in the attack?

The operator ran Cairn, an open-source agent-orchestration platform, with worker logs tagged claudecode_deepseek-v4.1-flash — meaning Anthropic’s Claude Code served as the agent framework while DeepSeek’s V4.1 Flash model handled the underlying reasoning.

Did Anthropic’s Claude model do the hacking?

Not directly. Claude Code is an open framework that can run on top of different AI models, and the exposed logs indicate the attacker pointed it at DeepSeek’s model rather than Claude’s own. The framework provided the agent structure; DeepSeek provided the intelligence behind it.

How was the hacker caught?

Security researcher Snorre Fagerland of NorForge found the hacker’s Cairn control panels exposed on the open internet during a routine internet scan — not through any breach response or forensic trace. The panels showed live operations, targets, and in some cases secrets and credentials.

Which companies were named as victims?

Reuters named Deere, SharkNinja, and Cummins among the confirmed targets. Deere said it found no indication sensitive data was accessed; SharkNinja said the intrusion hit a standalone product-support site and was contained; Cummins said it’s investigating an incident on a site run by a third-party vendor.

How long did each successful breach take?

An average of 23 hours of largely autonomous agent activity per successful breach, from initial probing through gaining a working foothold.

How much human input did the attack actually require?

Under 100 Chinese characters of instructions to launch the autonomous process — reportedly a short directive to find a way to run code on each target and plant a web shell, not detailed exploit instructions.

Is this kind of campaign something smaller companies need to worry about?

Yes. The campaign targeted mid-size and large e-commerce operations, not just enterprise giants, and the economics that used to make smaller companies less attractive targets — the cost of human attacker time — don’t apply when the labor is an AI agent working for cents per attempt.

---

Last updated: October 21, 2026. Sources: Reuters — How one hacker used AI agents and a few thousand dollars to break into scores of sites · NorForge — Inside Cairn: Open Windows into Massive AI-Driven Cyber Operations · The Hacker News — Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites · Cairn — open-source agent platform (GitHub).

Related reading: Claude Code Deleted 48,000 Files. Here’s How to Stop It · Anthropic Caught Russia and China Weaponizing Claude · Microsoft: AI Gave Hackers a 24-Hour Head Start · The LiteLLM Breach Just Hit 2,500 AI Tool Stacks · DeepSeek V4 Review 2026 · AI Safety for Business: What Leaders Need to Know