AI Agents Reportedly Broke Into 100+ Business Websites for About $50 Each

TL;DR

According to The Next Web's October 19, 2026 coverage of Reuters reporting and NorForge research, a Chinese-speaking hacker used Cairn agents to break into websites belonging to more than 100 companies. The estimated token cost was roughly $50 per successful break-in, with considerable uncertainty. Reuters could not establish how much data, if any, was taken. For site owners, the practical response is to review exposed panels, upload handling, credentials, and agent permissions.

What happened

NorForge principal threat researcher Snorre Fagerland observed the activity through exposed Cairn control panels. Cairn is an open-source AI problem-solving platform: an operator supplies a target and goal, agents work through steps and share findings on a board, and the operator can add hints.

The reported campaign began September 25. Fagerland began finding open panels around October 2 using internet scanning tools. NorForge judged more than 20 panels likely malicious, grouping the activity into three clusters.

The Chinese-language cluster had more than 1,100 attack projects across 14 panels. Its typical targets were online shops in the US, Canada, Japan, and Australia. The source gives traffic figures of 200,000 to 1.5 million without specifying a measurement period, so those figures should not be read as monthly visits.

The tasks asked agents to find a way to run code, then plant an uploader web shell, a form that saves uploaded files. NorForge assessed the apparent aim as lasting access to shop and payment systems. It checked one claimed intrusion at a large hardware parts vendor and found the web shell live. Reuters reported attempts against more than 1,200 sites.

Observed tasks used the worker label claudecode_deepseek-v4.1-flash. NorForge said this could mean Claude Code running DeepSeek V4.1 Flash; the label alone does not confirm that setup. Successful attacks reportedly averaged a little under 23 hours. Estimated costs were about $5,000 in tokens overall, roughly $50 per successful hack, or about $5 per task including failures. These are rough estimates, not reliable prices for future attacks.

Reuters identified Deere, SharkNinja, and Cummins among the affected organizations, with important qualifications:

• Deere said it took remediation steps and had no sign that sensitive information was accessed.
• SharkNinja said the affected system was a standalone product support site and that it contained the threat.
• Cummins said it was investigating a possible attack on a website run by one of its vendors.

The Next Web had not independently verified the intrusions. Reuters could not establish how much data was taken. Those limits matter when describing the scale and consequences.

Why this matters for small sites and online shops

The practical concern is delegated persistence. In one reported case, agents found no flaw in a company's public application, then pursued a linked control panel and eventually reported getting its server to run commands. That suggests owners should review connected systems alongside the main site.

There is a second exposure to consider. NorForge found hundreds of target credentials, API keys, and other secrets in open panels. Trufflehog verified 11% of the exposed secrets as valid. Some legitimate security testing firms had also exposed client work through their panels.

These observations support reviewing both your public website and the systems used to test or manage it. They do not establish that outdated plugins caused most intrusions, that every small shop faces the same risk, or that the reported costs guarantee attacker profits.

A practical checklist

The following are recommended defensive checks, rather than confirmed explanations for every intrusion in the report.

• Review software maintenance. Inventory your CMS, plugins, themes, and supporting applications. Apply relevant security updates and remove unused components through your normal change process. Ask whoever maintains the site to document outstanding fixes and ownership.
• Review exposed panels. Identify admin, hosting, staging, backup, and testing interfaces. Remove unnecessary public access. Where appropriate, restrict access through a VPN or IP allowlist and require multi-factor authentication. Include vendor-managed systems in the conversation.
• Make uploads non-executable. Review what the server does after accepting a file. Use appropriate file validation and storage outside the web root where possible, and configure upload storage so uploaded content cannot execute as code. Extension filters alone should not be your protection plan. Investigate unexpected scripts or upload forms.
• Use a WAF and rate limits as layers. Review these controls alongside application fixes, access restrictions, and monitoring. Do not treat a web application firewall or request limit as full protection against the activity described here. Check what traffic is blocked and what still reaches the application.
• Rotate secrets according to exposure. Investigate credentials leaked, shared beyond their intended users, or stored in repositories or exposed panels. Revoke or rotate affected secrets and review their use. Scan your own repositories and configurations for leaks. A secret's age alone does not establish exposure.
• Review file changes and alerts. Monitor unexpected changes to application files and upload locations. Assign someone to investigate alerts and preserve relevant logs. Avoid assuming monitoring will detect every web shell or deliver a finding within a fixed time.

If you run AI agents yourself

Microsoft's October 19 security blog, by Nadim Abdo, addresses agent governance. It is separate guidance, not a finding about how the Cairn intrusions happened.

Microsoft says its discovery coverage is expanding by 35 local agent types to 60 total, including Claude Code, OpenAI Codex, and GitHub Copilot. Discovered agents can be brought into a unified registry.

Separately, Microsoft says it is extending Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents. Discovery coverage and identity types are distinct announcements.

For your own deployment, consider these principles from the post:

• Limit starting access. Begin with no permissions or least privilege. Keep enforcement outside the model; the model should not be its own security boundary.
• Give agents accountable identities. Record ownership and distinguish agent activity from the sponsoring person's activity.
• Bound consequential actions. Microsoft describes Dynamic Permissions as task-scoped and time-bound, with human approval for high-impact actions. It also introduces Dynamic Agent Risk and Dynamic Conditional Access for agents, extending Entra Conditional Access.

Use these as review questions for your environment. An announcement alone does not establish which controls are available or configured in your deployment.

Check your own site

Start with Protego's free vulnerability scanner, then review its results alongside your maintenance records and access controls. Avoid treating a scan result as proof that a website is secure.

Protego also offers a $14.50 automated AI pentest, based on Strix. Use it only on sites you own. Review the service information before deciding whether it fits your testing needs. Neither CTA promises to reproduce this campaign or find every weakness.

FAQ

Does the worker label prove Claude Code was involved?

No. NorForge offered that interpretation as a possibility. Preserve that uncertainty rather than presenting the label as a confirmed product configuration.

Were credit cards stolen in this campaign?

Reuters could not establish how much data, if any, was taken. The source also describes a separate September Gambit Security report involving at least 600,000 credit card records from 25 companies. Do not combine those figures with this campaign.

Does a smaller website have nothing to worry about?

The reported targets included online shops, but the evidence does not provide a risk estimate for your site. Review your actual exposure rather than relying on company size.

What should I do first?

Identify who owns your public panels, upload handling, and credentials. Prioritize confirmed exposure and relevant security fixes. The report does not establish a single most common entry point.

Sources

• The Next Web, October 19, 2026, covering Reuters reporting by Raphael Satter and NorForge research by Snorre Fagerland.
• Microsoft Security Blog, Nadim Abdo, October 19, 2026.