One person, working mostly alone, let AI agents run a hacking campaign against more than 1,200 websites and broke into over 100 of them. The bill came to about $5,000.
A Chinese-speaking hacker spent roughly $50 in AI tokens per target and let autonomous software do almost everything else, according to a Reuters investigation published October 19. The campaign started on September 25 and hit e-commerce sites across the United States, Canada, Australia and Japan, breaching companies including farm equipment maker Deere, appliance maker SharkNinja and engine manufacturer Cummins.
Snorre Fagerland, principal threat researcher at the security firm NorForge, found the operation almost by accident. He was scanning the internet for exposed deployments of Cairn, which he began tracking around October 2 when he found about two dozen instances, an open-source AI agent platform popular with hackers, when he stumbled on the hacker’s infrastructure sitting wide open. The instructions driving the whole campaign fit in fewer than 100 Chinese characters. The agents took it from there, probing targets for hours with almost no further direction.
A successful break-in took about 23 hours from first scan to final access, Fagerland told Reuters. Multiply that by the volume: more than 1,200 websites attempted, over 100 breached, for a total spend of around $5,000. That is a cost per victim lower than a single hour of a junior penetration tester’s time, delivered by a workforce that does not sleep, does not get bored scanning the same login page for the fortieth time, and does not need a cut of the proceeds.
This is not an isolated case. Five weeks earlier, the cybersecurity startup Gambit Security uncovered a separate campaign, also built on Cairn, that hit around two dozen companies between September 10 and 15 and made off with more than 600,000 still-valid credit card numbers from two of them, according to BleepingComputer’s reporting on Gambit’s findings. That operation chained together three AI agents with different jobs: Strix for scanning, running on Z.ai’s GLM 5.2 and later DeepSeek V4 Pro; Cairn for end-to-end exploitation, running on DeepSeek V4.1 Flash; and Hermes for orchestration and direct hacking, running on Anthropic’s Claude Opus 4.6. Victims included a Fortune 500 hospitality company, a major US airline, an online fashion retailer and an industrial supplies distributor. The attacker’s own cost there: about $25 a target.
Anthropic flagged the shift from AI as advisor to AI as operator over a year ago. In November 2025, the company disclosed that a Chinese state-sponsored group it tracked as GTG-1002 had manipulated its Claude Code tool into running roughly 80 to 90% of an espionage campaign against about 30 organizations, including tech firms, banks, chemical makers and government agencies, with humans stepping in only to set strategy and approve a handful of decisions. Anthropic said at the time it believed that was the first documented large-scale cyberattack carried out without substantial human involvement.
What changed between then and now is who gets to run one. GTG-1002 was state-sponsored, well-resourced, and operating at the direction of a government. The campaigns Fagerland and Gambit found cost a few thousand dollars apiece and appear to trace to a single operator or a small group, using agent frameworks anyone can download. Anthropic’s incident showed a nation-state could automate cyberespionage. This one shows a freelancer can automate retail-scale credit card theft and corporate intrusion for the price of a used laptop.
Security teams built their detection playbooks around human attacker behavior: working hours that cluster around a time zone, fatigue that shows up as mistakes late in a session, a limited number of targets a person can realistically juggle. None of that holds when the attacker is software that can run 1,200 probes in parallel and never gets tired. The agents in both campaigns reportedly tried multiple approaches when one failed, adjusted tactics without being told to, and in the Gambit case, attempted to erase evidence of the intrusion afterward.
What was actually taken is still unclear. Reuters said it could not determine how much data was extracted in the breaches. Deere told Reuters it took “necessary remediation actions” and had “no indication that sensitive information was accessed.” SharkNinja said the affected site was a standalone one carrying only product support information and that the threat had been contained. Cummins said it was investigating a potential cyberattack on a website run by a third-party vendor. Two smaller businesses also acknowledged being compromised, and other victims did not respond.
Cairn’s author, who goes by le1xia0, told Reuters the platform is “an innovative type of multi-agent architecture” and was not designed for hacking. Whether the maintainers will restrict access to it after two campaigns built on top of it in the space of six weeks has not been said.
The Metropolix, from Startup Fortune
This article is posted in AI News, check it out for more related stories.
Almost there. Sign in and your reply posts straight away.
Click Here For The Original Source.
——————————————————–
