One Operator, 1,200 Sites: AI Intrusion Is Now a Commodity

On 19 October 2026, Reuters reported that a single Chinese-speaking hacker had used AI agents to break into the websites of more than 100 companies, among them Deere, SharkNinja and Cummins. According to the report, the operator began on 25 September 2026, aimed the agents at e-commerce websites in the United States, Canada, Australia and Japan, and by the week before publication had attempted to break into more than 1,200 sites.

The campaign was found by Snorre Fagerland, principal threat researcher at the security firm NorForge, who published his own analysis the same day under the title "Inside Cairn". He was scanning the internet for exposed instances of Cairn, an open-source AI platform, and from around 2 October 2026 found about two dozen being used for malicious activity. Fagerland told Reuters the hacker did almost none of the work. His estimate of the bill: roughly $5,000 in AI tokens.

This is not a frontier lab story and it is not a state story. It is the commodity case: freely available tooling, one operator, short instructions, and a target list long enough that nobody chose the victims individually. That changes which parts of a company's internet presence matter.

Key Takeaways

• The reported scale is 1,200 attempted and more than 100 reached. Reuters counts more than 1,200 sites attempted since 25 September 2026 and websites of more than 100 companies broken into. Reuters identified the victims by reviewing the operator's own Cairn activity, and could not determine how much data, if any, was taken
• The cost is tens of dollars per target. Fagerland's estimate to Reuters is roughly $5,000 in tokens, or about $50 per successful hack. NorForge's report puts the average at about $5 per task including failures, and calls the uncertainty considerable
• Success here has a narrow meaning. NorForge estimates a success rate of around 10%, where success is the agent recording its own goal as met. NorForge validated a small number of cases and did not log into victim servers
• The named victims were hit at the edge. SharkNinja told Reuters the attack reached a standalone product-support site. Cummins said it was investigating a report concerning a website operated by a third-party vendor
• The attackers had the same hygiene problem. The campaign was visible because its operators left their control panels open to the internet. NorForge found hundreds of secrets in the exposed data, 11% of them verified as still valid
• The executive response is inventory and latency. Know every internet-facing property, give each an owner, and measure how long known flaws stay open on it

What Reuters and NorForge Actually Established

The two sources did different jobs, and the difference matters for how the numbers should be read.

NorForge supplied the discovery and the mechanics. Its report describes internet scanning platforms, Shodan and Censys, surfacing hosts that ran AI agent harnesses. Most required a login. Cairn panels were comparatively neglected. NorForge judged more than 20 exposed panels likely to be malicious and grouped them into three clusters by shared targets, language and instructions. The busiest cluster, which it labels AIA0001, is Chinese-language, spans 14 panels and more than 1,100 attack projects, and targets mostly the United States, Japan and Australia, with the apparent aim of lasting access to e-commerce and payment infrastructure. A second, English-language cluster of 10 panels focused on card and cryptocurrency theft. NorForge assessed all the apparent malicious activity as financially motivated and saw no obvious state-sponsored activity.

Reuters supplied the victims and the totals. NorForge's report did not name the companies. Reuters identified them by independently reviewing the hacker's Cairn activity, and put the questions to them. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the attack hit a standalone site holding only product support information and that the threat was contained. Cummins said it was investigating the report of a potential attack on a website operated by one of its third-party vendors. Two smaller businesses acknowledged being compromised, and other victims did not respond.

One geographic detail differs between the two. Reuters lists four countries, including Canada. NorForge's report describes the cluster's targets as mostly in the United States, Japan and Australia, with one task listing all four.

What the Agents Did, Step by Step

NorForge's description of Cairn is plain. Each job is a "project" with a starting point and a predefined goal. The agents work in cycles: they post "intents", the next steps they plan, and "facts", what they have discovered, to a shared board for that project. A human operator can add hints to the same board, and the exposed panels show operators feeding in credentials harvested elsewhere.

According to Reuters, the most prolific operator's instructions were terse, under 100 Chinese characters. A typical goal recorded in NorForge's report was a web shell placed on the target site. For AIA0001 projects that reached their goal, NorForge measured an average of a little under 23 hours from start to finish and about 140 recorded facts per project; one project ran for more than five days.

Reuters describes one case in which the agents failed to find a weakness in a large company's public-facing application, went looking for associated infrastructure, found a public-facing control panel, identified a subtle data-processing weakness, and after hours of trial and error got the server to run their commands. Fagerland's judgement, to Reuters: "It's not script kiddie stuff." The weaknesses NorForge names in its case studies are ordinary web application flaws, such as unauthenticated account modification and insecure error handling, found by persistence.

On the models involved, the sources are careful and so should readers be. Every AIA0001 task ran under a worker name that NorForge reads as a Claude Code harness driving a DeepSeek model, and NorForge says this is not confirmed. Reuters says only that the campaign appeared to use a mix of China's DeepSeek and Anthropic's Claude Code. The author of Cairn, who uses the handle "le1xia0", did not answer Reuters' questions and said in a post on X that the platform "was not designed for hacking attacks."

How Honest Is the 100 out of 1,200?

It is tempting to divide one number by the other and call it an 8% hit rate. The sources do not support that precision.

The 1,200 counts sites attempted. The 100 counts companies. NorForge's own figure, an average success rate "around 10%", is described in its report as an estimate, and coverage of the report notes NorForge's caution that the clusters pursue different goals and are not directly comparable. Most importantly, "success" means the agent's own record says the goal was met. NorForge checked some of these: it fetched one web shell address from a completed task and found the uploader live on a hardware vendor's site, and it validated the chain against one very large US retailer. It did not log into victims' servers. Reuters could not determine the extent to which the breaches led to data being taken.

So the defensible statement is this: an unattended system reached a foothold on roughly one site in ten that it tried, by its own account, with a small number of those footholds independently confirmed. That is a lower bar than a breach with data loss. It is also enough. A foothold on a web server is the starting position for card skimming, credential theft and resale of access, and by the researcher's estimate the operator paid about $50 for each one.

The cost figures carry the same warning. Fagerland's $5,000 and $50 are estimates. NorForge's report says it has no actual token-usage numbers, puts the average at about $5 per task counting failures, and says its cost estimates could be off by a clear margin.

A Second Data Point, Kept Separate

This is not the only documented case, and the earlier one should not be merged with it.

On 22 September 2026, Gambit Security published an interim report on a financially motivated operator who chained three open-source agents, one of them Cairn, against online retailers. Gambit recorded 105 attack projects launched between 10 and 15 September 2026, at least 27 companies compromised to varying degrees, and at least 600,000 unexpired credit card details taken from two companies. Card-skimming scripts were confirmed in place on 19 victims, and Gambit detected more than 100 further websites carrying a skimmer associated with the campaign. The operator's own records showed a mean cost of $25.46 per completed scan across 101 scans. Gambit labels the report interim and notes that parts of it rest on the operator's AI-generated logs.

NorForge cites the Gambit report as background, and The Hacker News, covering both on 20 October 2026, reports that no source links the two operations. We treat them as two separate observations of the same economics: different researchers, different evidence, the same tool in both, and a per-target cost in the tens of dollars each time.

Cost Collapse Moves the Target to the Long Tail

In April we set out why attacks had shifted from tool-assisted to agent-driven. In June, the Velocity Gap doctrine argued that exploiting a known flaw is the easier half of the vulnerability lifecycle, and that the metric executives need is the gap between weaponization and containment. In August, we covered Unit 42's NOVA as evidence that discovery had gone industrial at the well-resourced end. Our 14 October reading of the Microsoft Digital Defense Report 2026 dealt with AI agents as an attack surface. The Cairn campaign sits at the other end of that range: no novel research, no large team, and a result that still shows up in a Reuters headline.

When an attempted intrusion costs a few dollars, the attacker stops choosing. A human operator with limited hours prioritises targets that justify the effort. An agent that works for 23 hours without supervision has no such constraint, so the question is no longer whether a property is worth attacking but whether it is reachable and weak.

The named victims show where that lands. By the companies' own accounts to Reuters, the affected properties were a standalone product-support site and a website operated by a third-party vendor. These are the properties that sit outside the main security programme: the support portal built by an agency, the storefront inherited with an acquisition, the campaign microsite nobody decommissioned. They rarely hold the crown jewels. They do carry the brand, sometimes a payment page, and often credentials or integrations that lead somewhere more valuable.

What This Means for the Executive Team and the Deal Team

Build the inventory from the outside. The operator did not consult an asset register. Enumerate every domain, subdomain, storefront and vendor-hosted property that resolves to the company or its brands, as an outsider would, and reconcile it against what the security team believes it owns. The difference between the two lists is the exposure.

Give every property an owner or retire it. A site without a named owner does not get patched. For each internet-facing property the choice is binary: someone is accountable for it, or it is taken down.

Measure patch latency on internet-facing systems separately. The Velocity Gap applies here in its simplest form. If an agent needs around a day of unattended work to turn a weakness into a foothold, a monthly patch cycle on a public web application is an open invitation. Report the age of known flaws on internet-facing systems as its own number, not blended into an estate-wide average.

Hunt for exposed credentials and secrets, including in your own agent tooling. NorForge found hundreds of secrets in the exposed panel data, 11% verified as valid, and found legitimate red-team panels exposed as well. Any organisation running AI agent harnesses, internally or through a testing supplier, should confirm that their control panels are not reachable from the internet.

For sponsors, run it across the portfolio. A campaign like this does not respect the boundary between portfolio companies or between a platform and its bolt-ons. The small sites are precisely the ones nobody at the sponsor level tracks. As we argued in our analysis of cyber due diligence for PE firms, an external assessment conducted without target access finds what questionnaires miss. The same method, applied across holdings on a recurring basis, turns an unowned long tail into a list with names against it. Before close, ask the target for its full list of internet-facing properties and compare it with what can be seen from outside.

Fagerland told Reuters he had assumed hacker agents would need supervision, and no longer does. Executives do not need to settle how much of the work the AI did to act on the finding that matters: attempts are now cheap enough to reach everything. Innovaiden's External Web Estate Review produces the outside-in inventory, the ownership map and the patch-latency baseline for a single company or a full portfolio.