Andy Garcia · freelance dev
FRENES
Back to the blog
Security

One Hacker's AI Agents Broke Into More Than 100 Companies' Websites at About $50 Each. The Open Dashboards Leaked the Targets' Secrets Too.

October 19, 2026 8 min read

On Monday, October 19, Reuters reported that a Chinese-speaking hacker had broken into websites belonging to more than 100 companies, including farm equipment maker Deere, appliance maker SharkNinja and engine manufacturer Cummins, while doing almost none of the work. AI agents did it. The account comes from Snorre Fagerland, a researcher at the security company NorForge, who published his report, "Inside Cairn", the same day.

Fagerland found the campaign by scanning the internet for exposed control panels of Cairn, an open-source platform that sets AI agents to work on a problem, from a starting point to a goal. He started looking after Gambit Security reported in September on an intrusion campaign whose staging server held Cairn among other agent harnesses. More than 20 of the panels he found were likely malicious, and they appeared completely unprotected.

I orchestrate my own work with Claude Code, and the worker name at the center of this report starts with "claudecode". So I read it twice: once as someone who has web pages to defend, once as someone who runs agents.

What the companies say

The statements are careful and worth reading as written. Deere told Reuters it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Two smaller businesses acknowledged being compromised; other victims did not return messages. Reuters could not establish how much data, if any, was taken.

NorForge's report names no victims. Reuters identified them by independently reviewing the hacker's activity on the exposed panels.

Two of the three named statements point to the edge of the company: a standalone support site, a site run by a vendor. On October 14 I published a piece on the breaches at Korean lenders, where investigators said a human was still at the controls and the ways in were employee and partner portals. Same edge. Here, according to Fagerland, the hacker did almost none of the work.

The arithmetic

NorForge splits what it saw into clusters. The Chinese-language one, which it calls AIA0001, was by far the busiest: more than 1,100 attack projects across 14 panels. According to Reuters, the campaign began on September 25 against e-commerce sites in the US, Canada, Australia and Japan, and by late in the week before publication its agents had tried more than 1,200 sites.

Three numbers from the report do most of the work.

About $5 per task on average, counting the attempts that failed or ended early. Long projects could pass $100, and NorForge writes that "the uncertainty here is however considerable."

About 10 percent average success rate across the harnesses it observed, with many of the other tasks reaching partial goals or gathering information for later attempts.

A little under 23 hours, on average, from start to goal for the successful AIA0001 projects, with about 140 facts logged per project. One ran for more than five days.

Divide the first by the second: $5 / 0.10 = $50 per success. That is the figure Fagerland gave Reuters, along with a total of roughly $5,000 in tokens for the campaign. And $5,000 / $50 = 100 successes, in line with "more than 100 companies". It is rough by construction, since NorForge says its clusters are not directly comparable, but the estimates hold together.

For a defender, the useful reading is the marginal one. Adding your forgotten support site to that queue costs the attacker about $5. Fagerland told Reuters he had assumed hacking agents would still need some supervision, and that the technology had obviously moved past that.

The brief, read closely

The report quotes a typical AIA0001 task. The targets are "confirmed real shopping/e-commerce websites" in four countries, with traffic between 200,000 and 1.5 million, and "Playwright has verified that orders can be placed." The objective is unauthenticated remote code execution. The priorities: "Login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass, account takeover."

Then the payload: an uploader shell, an HTML upload form that saves files, "explicitly not a command-executing webshell." That line matters more than it looks. A form that only saves files is quieter than a shell that runs commands, and NorForge notes that attackers "can at any time change that into something more malicious." It checked one completed task against a large hardware parts vendor, and the shell URL did serve an uploader. According to the agent's own explanation, the way in combined write access to a memcached session store, unsafe PHP object deserialization and a gadget chain in legacy Zend Framework components.

The toolkit NorForge saw in one exposed working directory fits that brief: PHPGGC for PHP deserialization payloads, a Docker lab for Magento Open Source 2.4.9, Odoo artifacts, Nmap, ffuf, OWASP Amass. This crew was tooled for commerce platforms, PHP ones above all.

Being a target can already be a leak

The Reuters story does not get to this part. The panels did not only show that a site was being tested. They showed everything the agents discovered along the way, plus operator input that included credentials harvested elsewhere. NorForge ran the TruffleHog secrets scanner over the data and found "Literally hundreds of secrets", with 11 percent verified valid. Its conclusion: "having your site tested on an open Cairn instance is often a serious security issue, regardless of outcome of the test."

So the attempts that failed were not harmless. If your site sat on one of those panels, what the agents found about it was exposed to anyone who stumbled on the panel, not only to the attacker.

Legitimate work leaked the same way. NorForge found apparently genuine red-team engagements on unsecured panels, "potentially placing clients at risk." If you buy penetration tests, that is now a procurement question.

The panels also appeared to expose full administrative controls: starting and stopping projects, inserting data, redirecting agents to different targets. NorForge did not test whether those controls worked without authorization, "for reasons that should be fairly obvious."

The harness and the model

From what NorForge saw, every AIA0001 task ran on a worker named "claudecode_deepseek-v4.1-flash". NorForge says that "could mean" a Claude Code harness using DeepSeek's 4.1 Flash model. Reuters describes the campaign as appearing to use a mixture of DeepSeek and Anthropic's Claude Code. AIA0002, an English-language cluster focused on financial theft, named its workers "pi_openrouter_deepseek".

The plumbing for the first reading is public. DeepSeek's API documentation has a section on using its models in Claude Code through an Anthropic-compatible endpoint. One agent task update also quoted a skill file at ".claude/skills/tsec-actions/SKILL.md", the project-skill layout that Claude Code's documentation describes. NorForge reads it as a setup from a capture-the-flag competition framework, reused by criminals, and sees no reason to think the competition's organizer was involved.

What I take from that: the harness is a commodity, the model is a line in a config file, and a competition setup became an intrusion setup by changing the brief. No single model vendor's guardrails cover that whole stack. The defense has to sit on your side.

What I would check

The sites under your name that you do not run. Support sites, campaign pages, vendor-run portals. For each one: who patches it, how fast, and who answers when a researcher or a reporter writes to you.

What the application trusts without checking. Session stores, caches, upload directories. Nothing outside the application should be able to write to them.

The shell they asked for. Look for new PHP files in web directories, especially upload forms. Another cluster told its agents to hide the shell deep in the directory tree under an ordinary name, with "confirm.php" as the example.

Secrets after a near miss. If you learn you were a target, rotate keys even if nothing got in. The panel may have published what the agent found.

Your pentest vendor's panel. Ask where its agent control panel runs, who can reach it, and what happens to the secrets it collects. Put the answer in the contract.

Your own agents. If you run them, as I do with Claude Code, the lesson cuts both ways. A dashboard that shows what an agent found, or lets someone steer it, needs authentication, and secrets do not belong in an agent's shared notes.

The attackers automated the break-in and left their own dashboards open. By NorForge's estimate, a serious try at your forgotten site now costs about five dollars and a success about fifty, and the cheapest defense is still knowing that the site exists.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk