Security briefs

Did AI agents really breach more than 100 company websites for $50 each?

Published 26 October 2026Updated 26 October 2026

Yes, according to Reuters and the NorForge researcher it quotes. One operator pointed AI agents at more than 1,200 web shops from 25 September and Reuters tied the intrusions to more than 100 companies. At around $50 a success, a forgotten side system is worth a try.

What happened

NorForge researcher Snorre Fagerland began finding open control panels for Cairn around 2 October. Cairn is an open-source platform that coordinates AI agents. Reuters reported on 19 October that one Chinese-speaking operator had pointed those agents at e-commerce sites in the US, Canada, Australia and Japan from 25 September. By late the week before they had tried more than 1,200 sites, and the breaches covered websites of more than 100 companies, among them Deere, SharkNinja and Cummins.

Fagerland estimated about $5,000 worth of tokens for the whole campaign. That is roughly $50 per successful break-in, and a typical success took about 23 hours (Reuters, 19 October). NorForge's own report says about $5 per task once failed ones are counted, a success rate near 10 percent and considerable uncertainty (NorForge, 19 October).

Deere told Reuters it took remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the breach hit a standalone product support site and was contained, and Cummins is investigating a possible attack on a vendor's site. Two smaller businesses also acknowledged being compromised. Reuters could not establish how much data was taken.

The operator's task text, which NorForge translated, tells the agents to find unauthenticated code execution through SQL injection, file upload, deserialization, template injection or server-side request forgery. Then plant an upload-only web shell. NorForge's example chains use known weakness types, such as unsafe PHP deserialization in legacy Zend Framework components. Scale and price are the news.

Who is affected

• Any organization with public web apps, above all shops. The named operator picked shops with 200,000 to 1.5 million visits, in four countries.
• Side systems nobody watches: support sites, microsites, admin and control panels. In one reported case the agents found no flaw in a large company's main application, so they went after a public control panel nearby.
• Sites a vendor runs for you. Cummins named one.

NorForge says it is working with Reuters to warn victims, and the open Cairn panels also exposed hundreds of secrets, 11 percent of which Trufflehog verified as valid. If a vendor or NorForge contacts you, rotate keys first. Questions come second.

What to check now

1. List every public hostname you or a vendor runs for you. Include support sites, microsites and admin panels. NorForge found OWASP Amass in the agents' tool folder, so run the same discovery on your own domain.

   amass enum -d example.com

2. Ask each vendor in writing which sites it hosts for you, on what software and version, and whether it kept logs since 25 September, the day the campaign began.
3. Look for the payload NorForge describes, an upload-only PHP web shell. Real upload handlers match the first command, so compare the hits with the files you expect.

   grep -rl move_uploaded_file /var/www --include='*.php'
   find /var/www -type f -name '*.php' -newermt 2026-09-25

4. Test the weakness types from the task text on your own sites. Start with login SQL injection, unauthenticated endpoints, file upload, deserialization and authentication bypass. For uploads, send a harmless .php file and confirm the site refuses it.
5. Scan repositories and config for live secrets, and rotate any that sat on an exposed or vendor-run site.

   trufflehog git file://. --only-verified

6. Alert on new executable files in upload folders, and on one source probing a site for hours.

What should have been in place

• A current inventory of every public site, each with a named owner, and for vendor-run sites a contract that sets patch times and breach notice.
• Fast patching of known flaws in shop and CMS software. NorForge found a proof of concept for a Magento flaw, CVE-2026-75650, in one agent folder.
• Upload folders that cannot execute code, and code deployed read-only, so an uploaded web shell has nowhere to run.
• Rate limits and alerts. Successful runs took about 23 hours against one site, long enough to notice.
• Scoped, expiring secrets. A key stolen from a site hurts more when it still works.

Questions people ask

Digiton's production review checks what each deployment exposes and how it behaves under abuse, and the checks are listed on the vibe coded app audit page.

Sources

1. Reuters, how one hacker used AI agents to break into scores of sites (syndicated copy on AOL), 19 October 2026, read 26 October 2026. https://www.aol.com/articles/exclusive-one-hacker-used-ai-100403000.html
2. NorForge, Inside Cairn: open windows into massive AI-driven cyber operations, 19 October 2026, read 26 October 2026. https://norforge.com/blog/inside_cairn
3. The Next Web, AI agents broke into 100+ sites for one hacker at $50 each, 19 October 2026, read 26 October 2026. https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge
4. WinBuzzer, hacker used AI agents to breach 100+ company websites, 20 October 2026, read 26 October 2026. https://winbuzzer.com/2026/10/20/hacker-used-ai-agents-to-breach-100-plus-companies-websites-xcxwbn/

More security briefs

All security briefs