AI agent hacking, long treated as a theoretical worry confined to research labs, has quietly become a working business model. The report landed on Monday and read less like a security advisory than a dispatch from the near future. A single operator, working largely unsupervised, had turned a cluster of autonomous software agents loose on the open internet and watched them break into more than 100 company websites. The total bill, measured in the tokens that power large language models, came to around $5,000. That works out to roughly fifty dollars per successful intrusion.
By Blumefield | October 21, 2026
A Fifty-Dollar Break-In
The findings came from Snorre Fagerland, a principal threat researcher at the Norwegian security firm NorForge. Fagerland had been scanning the internet for exposed control panels when he stumbled onto something unusual. Dozens of operators were running an open-source multi-agent framework called Cairn, and many had left their dashboards sitting unprotected online. On those panels he found the raw logs of an automated campaign that had tried to break into more than 1,200 sites, succeeding against a meaningful fraction of them.
What makes the episode so striking is not the number of victims but the division of labor. The human set a target and a goal. The agents did almost everything else, reading one another's notes on a shared board, probing for weaknesses, and grinding through hours of trial and error without a person watching over each step. "It's not script kiddie stuff," Fagerland wrote, and the data backs him up. It is a pattern Blumefield has tracked across a string of agent-driven security incidents this year.
How the Machines Did the Work
Cairn was not built for crime. Its author, who posts online under the handle le1xia0, describes it as a general multi-agent architecture and has said plainly that any harmful use runs against his intentions. Yet the same qualities that make such frameworks useful for legitimate automation, namely persistence, coordination, and the ability to chase a fuzzy objective across many steps, are exactly what an attacker wants. Point the system at an online store, tell it to find a way in and hold access, and it sets to work. This is what AI agent hacking looks like in practice, and it barely needs a human in the loop.
According to NorForge's analysis, the largest and most clearly malicious cluster linked fourteen exposed panels to more than 1,100 attack projects. The agents favored online retailers in the United States, Canada, Japan and Australia, the kind of mid-sized shops with enough traffic to be worth robbing and rarely enough security staff to notice an intruder. In the cases that worked, the software attempted to run its own code on a target and plant a hidden uploader, a foothold designed to preserve access to shopping and payment systems. One confirmed break-in, at a large hardware parts vendor, still had a live backdoor when researchers checked.
The workhorse behind the campaign carried a revealing label. Every task ran through a process named for a combination of a popular coding assistant and DeepSeek's low-cost V4.1 Flash model, a pairing that reads like a recipe for cheap, tireless automation. Successful intrusions took just under 23 hours on average, time the operator spent doing nothing in particular while the machines ground away.
The Economics Have Flipped
For most of the internet era, serious hacking has been gated by human expertise. Finding a novel flaw, chaining it into access, and maintaining a foothold required skills that took years to build and commanded high prices on criminal markets. That scarcity acted as a natural brake on the volume of attacks. The Cairn campaign suggests the brake is failing. When AI agent hacking costs about fifty dollars a target and runs while the attacker sleeps, the calculus that once protected the long tail of ordinary businesses stops working.
The numbers deserve scrutiny, and NorForge is careful to flag the uncertainty. The fifty-dollar figure is a rough estimate of token spend on successful hits, while the average cost across all attempts, including the many that failed, lands closer to five dollars per task. The observed success rate hovered around ten percent. None of that is cause for comfort. A ten percent hit rate at five dollars a swing is still a devastating ratio when the swings are automated and effectively unlimited.
This is not an isolated anomaly. A separate report in September tied agent-driven activity to the theft of hundreds of thousands of payment card records across two dozen companies. Government agencies in Taiwan and India have each warned this year that autonomous agents helped intruders reach live systems. The direction of travel is unmistakable, and it points toward a world where AI agent hacking makes offensive capability a commodity rather than a craft.
A New Attack Surface Nobody Mapped
The story of AI agent hacking does not end with the breached storefronts. The campaign exposed a second danger that may prove more consequential than the break-ins themselves. The very control panels the attackers used were left wide open, and NorForge found them with ordinary internet scanning tools. Inside were hundreds of stored credentials and API keys. Using a common secret-scanning utility, researchers verified that roughly one in nine of those secrets was still valid and usable.
In other words, the tools of AI agent hacking are themselves insecure, leaking the keys to both the attackers' infrastructure and, in some cases, the systems of legitimate security testers who had left client engagements exposed. The rush to deploy autonomous agents has created a sprawling, poorly guarded layer of dashboards, logs and credentials that sits on the public internet waiting to be harvested. Defenders now face not one problem but two, the agents attacking their systems and the agent infrastructure spilling secrets into the open.
Anthropic and other frontier labs have published their own threat intelligence in recent months, documenting how their models are pulled into malicious campaigns and detailing the countermeasures they deploy. The honest lesson of the Cairn affair is that no single lab controls the supply. Open-source frameworks, cheap models from multiple vendors and freely available tooling can be stitched together by anyone, and no terms-of-service clause reaches that far.
What Defenders Do Now
The defensive playbook is not a mystery, but the urgency has changed. Basic hygiene, patching public-facing applications quickly, rotating credentials, locking down forgotten admin panels and watching for the telltale signs of an automated probe, matters far more when the attacker never tires and never raises its hourly rate. The uncomfortable truth is that many of the breached sites fell to known weaknesses, not clever new exploits. The agents simply had the patience to find them.
Regulators and security agencies are beginning to respond. Guidance from bodies such as the United States Cybersecurity and Infrastructure Security Agency increasingly treats AI-accelerated intrusion as a baseline assumption rather than a frontier scenario. Academic groups, including dedicated AI security research centers in Europe, are racing to study how agent swarms behave and how they can be detected and disrupted before they scale further.
For business leaders, the takeaway from this round of AI agent hacking is less about any single vulnerability than about volume and velocity. The economic floor under cybercrime has dropped, and the number of plausible attackers has risen with it. Companies that once assumed they were too small or too dull to draw attention no longer enjoy that luxury. In an age of autonomous agents, obscurity is not a strategy, and the window to shore up defenses is closing faster than most boards appreciate. The machines, as Blumefield's reporting keeps underscoring, are already at work.