Article 302: One Hacker, $5,000 of Tokens, 100+ Breached Sites - and Under 100 Chinese Characters of Instruction

NorForge principal threat researcher Snorre Fagerland gave Reuters a report on Monday describing a campaign that ran from 25 September against e-commerce sites in the US, Canada, Australia and Japan. By late last week the agents had attempted more than 1,200 sites and broken into over 100 companies, including farm equipment maker Deere, appliance company SharkNinja and engine manufacturer Cummins. The operator's entire instruction set was fewer than 100 Chinese characters sketching preferred tactics. The agents did the rest: roughly 23 hours of autonomous probing per successful intrusion, at a total token cost Fagerland estimates at about $5,000 - around $50 per compromised site.

Fagerland found it by accident, scanning for exposed instances of Cairn, an open-source multi-agent problem-solving platform popular with criminals. From around 2 October he identified about two dozen Cairn instances in malicious use, which let him watch over the operators' shoulders. The Chinese-speaking actor was the most prolific; others stole card data and one attempted to rob a cryptocurrency exchange. The model mix appeared to be China's DeepSeek alongside Anthropic's Claude Code. In the standout case, agents failed to find a weakness in a large company's public application, went looking through digital records for associated infrastructure, found a public-facing control panel, identified a subtle flaw in how it processed data, and after hours of trial and error reported a method for tricking the server into executing malicious commands.

Key Takeaway: Fagerland spent nearly three decades in security and said he was impressed: "It's not script kiddie stuff." That is the finding, not the breach count. The assumption that autonomous hacking would still need a human nearby has quietly expired, and the evidence is a working intrusion chain - reconnaissance, lateral thinking, exploit construction - executed by commodity tools against commodity targets. The economics are the second half of the story. $50 per breach does not need a nation-state behind it; it fits on a stolen card and a free trial, which moves the threat from "sophisticated adversary" to "anyone with a grudge and a payment method". Note the vendor split, too: a Chinese open-weight model and an American coding agent, sold to the attacker by the same API marketplace that sells them to you. Cairn's author told Reuters the platform "was not designed for hacking attacks", which is true in the way that a hammer is not designed for murder. Security teams now have to price the marginal cost of an attack attempt at roughly zero, and build defences for a world where patience is free.

Sources: Reuters, "How one hacker used AI agents and a few thousand dollars to break into scores of sites", 19 October 2026; NorForge report via Reuters