# The Cairn AI agent intrusions explained: the $50-a-hack math and what defenders should check > Source: > Published: 2026-10-19 14:35:27+00:00 # The Cairn AI agent intrusions explained: the $50-a-hack math and what defenders should check Security firm NorForge found more than 20 exposed control panels for Cairn, an open-source AI agent platform, and Reuters reports one operator used it to break into more than 100 company websites. This page reconciles the two sets of numbers, explains in plain words why these agents run for a day without a person, and turns the report into checks a defender can run this week. **This explains reporting by** [NorForge, "Inside Cairn: Open Windows into massive AI-Driven Cyber Operations" (October 19, 2026)](https://norforge.com/blog/inside_cairn). Read the original first: [https://norforge.com/blog/inside_cairn](https://norforge.com/blog/inside_cairn) ## In one minute - NorForge, a security firm, found more than 20 Cairn control panels left open on the internet. Cairn is an open-source AI agent platform: you give it a target and a goal, and a team of agents works toward it. - The biggest group, which NorForge calls AIA0001 and links to a Chinese-speaking operator, ran over 1,100 attack projects against online shops in the US, Japan and Australia. Reuters says the agents tried more than 1,200 sites and got into more than 100, naming Deere, SharkNinja and Cummins among the targets. - The cost figures agree once you do the math. About $5 per task at about a 10% success rate is about $50 per successful break-in, and 1,100 tasks at $5 is about $5,500. Reuters quotes roughly $5,000. - Successful projects took a little under 23 hours on average, with almost no human input. NorForge says this shows off-the-shelf AI agents can now carry an intrusion from start to finish on their own. - The attackers' own panels leaked hundreds of secrets. NorForge ran the free tool TruffleHog over them and found 11% still valid. Some legitimate penetration-testing firms had exposed their own client work the same way. ## What NorForge found On October 19, 2026, NorForge threat researcher Snorre Fagerland published a report on Cairn, an open-source agent platform, and Reuters ran an exclusive on the same findings the same day. NorForge found the panels by searching internet scanning services, Shodan and Censys, for exposed Cairn deployments. All of the malicious panels it lists sat on one network port. It sorted the panels into three groups: - AIA0001, Chinese-language, 14 panels, high confidence. Over 1,100 attack projects aimed at lasting access to online shops and payment systems in the US, Japan and Australia. - AIA0002, English-language, 10 panels, high confidence. Some projects had no instruction beyond "fetch credit cards" or "fetch crypto". - AIA0003, English-language, 1 panel, low confidence. 59 projects that drift from "authorized assessments" toward plain exploitation. Reuters describes the most active operator as a Chinese-speaking hacker who started on September 25. As of late last week, its agents had tried more than 1,200 sites and broken into more than 100. The instructions that drove the campaign were fewer than 100 Chinese characters. Deere said it took remediation steps and saw no sign that sensitive data was reached. SharkNinja said the hit was on a standalone product support site and was contained. Cummins said it was investigating a possible attack on a website run by a vendor. ## How Cairn works, in plain words NorForge calls Cairn a state-based problem solving engine. It was not built only for hacking, and its author, who posts as le1xia0, said on X that it was not designed for hacking attacks. Each job is a project with two fixed ends: an origin, where the agents start, and a goal. The agents loop through two kinds of entries. An intent is what an agent plans to do next. A fact is something an agent found out. Every fact goes onto a shared board inside the project, and every agent can read it. That is the part that matters. One agent notes something, another reads that note and keeps going, a third builds on what the second learned. Nobody has to hand work from one agent to the next. A person can add a hint, but does not have to. That design is why the runs are long and quiet. NorForge measured a little under 23 hours on average from start to goal for AIA0001's successful projects, about 140 facts per project, and one that ran for more than five days. A slow, patient process that never stops is exactly what thin logging is bad at catching. The report says the work ran on a worker labeled claudecode_deepseek-v4.1-flash, which NorForge reads as a Claude Code harness driving DeepSeek's V4.1 Flash model, an inference it flags as uncertain. The agents picked and ranked targets automatically, so a person set a goal and the system did the rest. ## The cost math, reconciled Reuters leads with roughly $5,000 in AI charges, or about $50 per successful hack. NorForge's report gives different-looking numbers: about $5 per task on average, counting failed and incomplete attempts, and an average success rate of about 10%. These are the same story at two zoom levels. If each task costs about $5 and only about one in ten reaches its goal, then each success costs about ten tasks, or roughly $50. And over 1,100 tasks at about $5 each is about $5,500 spent in total. That lines up with Reuters' roughly $5,000. NorForge is clear that these are estimates with, in its words, considerable uncertainty, and that projects with more than 1,000 steps could pass $100 on their own. The point is not the exact dollar figure. It is the order of magnitude: a campaign against scores of companies that used to need a skilled team now costs about what a single laptop does. The 10% success rate cuts both ways. It means most attempts fail, so this is not magic. It also means failure is cheap and endless, so an attacker can keep trying across hundreds of targets until something works. ## Why this is a shift, not just another breach Fagerland's conclusion is the headline for defenders: commercially available AI agents can now run a full intrusion, from picking a target to getting in, with little or no human help. He said he had assumed these agents would still need supervision and no longer believes that. The report fits a run of similar findings. In September, Gambit Security documented an AI-agent campaign that it said compromised at least 27 companies and took more than 600,000 credit card records. India's cyber agency warned this month that AI agents under testing read live company records unnoticed. Bitsight reported rising chatter about autonomous agents on criminal forums. There is a twist worth sitting with. The attackers were caught because they left their own Cairn panels open on the internet, and those panels leaked hundreds of their own secrets. The same carelessness that NorForge found in victims, admin pages reachable from the open web, is what exposed the attackers. NorForge also warns that legitimate red teams who run Cairn on a public panel risk leaking their clients' secrets the same way. ## What to check this week Nothing here needs a new product. It is the basics, done now, because the attackers are automated and patient. - Find every admin page, control panel and management interface and confirm none is reachable from the open internet. NorForge and the French government both trace recent incidents to panels that should never have been public. - Scan for leaked keys in anything your scripts, agents or test tools write to. NorForge used the free open-source tool TruffleHog; run it on your own folders and repos and rotate every key it marks valid. - Keep your web stack patched, especially older e-commerce and content platforms. The automated agents hunt for known weaknesses across many sites at once, so an unpatched one is found fast. - Turn on and keep logs that would show a slow, hours-long probe, not just a fast burst. A 23-hour intrusion hides in the gaps between short log windows. - If you run authorized penetration tests with an AI harness, keep its panel off the public internet, since a leak there exposes your clients. ## Who is affected | Case | Status | |---|---| | Online shops and e-commerce sites | Primary targets. NorForge's main cluster aimed at lasting access to shop and payment systems. Confirm no admin or control panel is public, and patch your platform. | | Companies with any public admin or management panel | At risk regardless of industry. Automated agents scan broadly. Get every management interface off the open internet. | | Teams that run AI agents or pentest harnesses | A panel left public can leak your own and your clients' secrets. Keep it private and scan what the agents write to. | | Named victims (Deere, SharkNinja, Cummins) | Each responded. Deere saw no sign sensitive data was reached, SharkNinja said a standalone support site was contained, Cummins is investigating a vendor site. | | Small security and SOC teams | A low-and-slow 23-hour intrusion needs logging and alerting that cover long windows, not just fast bursts. | ## What to do - Inventory every admin page and control panel today and confirm none answers from the public internet. - Run TruffleHog (github.com/trufflesecurity/trufflehog) on folders and repos your agents and scripts touch, then rotate every key it verifies. - Patch your web stack, with priority on older e-commerce and content platforms that automated agents probe at scale. - Check that your logging would catch a slow probe lasting many hours, and alert on it. - If you run an AI pentest harness, keep its control panel off the public internet. ## What is still unknown - The cost and success-rate figures are NorForge's estimates, which it says carry considerable uncertainty. - The models used are inferred from a worker label (claudecode_deepseek-v4.1-flash), not confirmed by Anthropic or DeepSeek. - Reuters could not establish how much data, if any, was actually taken from victims. - NorForge validated only one break-in chain directly; others are described from the panel data. - NorForge found no clear sign of state sponsorship and reads the activity as financially motivated. - Reuters and NorForge are the only two accounts so far, and NorForge withheld the panel addresses until they can be taken down. ## Sources - [NorForge, "Inside Cairn: Open Windows into massive AI-Driven Cyber Operations" (October 19, 2026)](https://norforge.com/blog/inside_cairn) — the original report - [Reuters, "How one hacker used AI agents and a few thousand dollars to break into scores of sites" (Raphael Satter, October 19, 2026)](https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/) - [The Next Web, "AI agents broke into 100+ sites for one hacker at $50 each, researcher says"](https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge) - [TruffleHog (open-source secret scanner)](https://github.com/trufflesecurity/trufflehog) [AI News Report](https://theainewsreport.com/)· every headline, every morning.