AI agents broke into the websites of more than 100 companies for about $50 each

A hacker gave AI agents instructions of fewer than 100 characters and let them try on their own, for about 23 hours per site. The target was not anyone's core system but the forgotten website: a support page, an online store, a page the vendor hosts.

In 30 seconds

What happened

An AI agent is a program that receives a goal and works on its own until it is done, without waiting for an order at each step. Like a tireless intern: it tries, fails and tries again. In this case, the goal was to get into store websites and plant an access point.

The operation was found by researcher Snorre Fagerland of NorForge. He scanned the internet for exposed control panels of a tool called Cairn, which is open source (anyone can download and use it). From about Oct 2, he found dashboards that showed, almost in real time, what the attackers were doing. Reuters saw the report before publication and cross-checked the logs against real companies.

What Cairn is, in plain language

According to NorForge, Cairn is a system that takes a target and a goal and coordinates AI agents to investigate the target, look for flaws and try to get in. Each task is a "project". The agents write what they discover on a shared board (NorForge uses the term "blackboard") that all of them read, and the human operator can add hints. The tool's author, who goes by "le1xia0", told Reuters it was not built for attacks and that he had no intention of causing harm.

The three groups of dashboards

AIA0001 is the most active: more than 1,100 attack projects across 14 dashboards, with targets mostly in the US, Japan and Australia. Sites are ranked by traffic, and Reuters mentions stores with 200,000 to 1.5 million visits. Before sending the task to Cairn, an automated test checks whether an order can be placed in the store, to confirm the site is a real store. NorForge assesses that all groups appear to be financially motivated, with no clear sign of government-linked activity.

What the typical task looked like

In AIA0001, the instruction asked the agents to find a way to run code on the site without logging in and to install an uploader: a page that only saves uploaded files and does not run commands. According to the coverage, it can later be swapped for a more dangerous tool. InferenceThe reason to use an uploader rather than a shell that runs commands is probably discretion. NorForge verified that this type of uploader was active at a large hardware parts supplier, and independently confirmed the breach of a very large US retailer.

Who was hit and what they said

Note the pattern: isolated sites and vendor sites. In the statements of the three companies, none mentions a breach of the core system.

What is known and what is not

Why $50, and why it matters

The number that made the headlines comes from two different calculations, and both are worth understanding. Fagerland told Reuters that the campaign spent about $5,000 on tokens, or about $50 per successful break-in. NorForge's report, in turn, calculates about $5 per task, counting the ones that failed, and an average success rate of about 10%. The denominators are different (successful break-ins versus all tasks), and NorForge itself warns that the groups are not directly comparable. Even so, the orders of magnitude match.

Some projects cost more: NorForge says those that go past a thousand "intents and facts" can exceed $100. InferenceThe practical point is another one. If an attempt costs a few dollars and runs unsupervised, the attacker almost never needs to get it right. It is enough to try on many sites and keep the ones that gave way.

OpinionThe risk did not change in size. It changed in price. Until recently, attacking a forgotten site took too much work for too little return. With attempts at a few dollars and no supervision, the math is different.

Fagerland himself told Reuters it is "not amateur stuff" and that he expected attack agents to still need some supervision. A summary of the case on DEV Community, based on the report, points out that the novelty is the scale and the little human involvement, not a new class of flaw: the known defenses still apply.

Executive view: risk, gain and decision

Risk

The forgotten site is the weak link. Support pages, campaign microsites, old stores and vendor-hosted sites tend to have a vague owner and outdated software. If nobody knows they exist, nobody patches them. That was exactly the profile of the cases cited.

Reputation and trust. A compromised site carrying your brand becomes your problem, even if a vendor operates it (the Cummins case). For stores and companies with online payments, the largest group's stated goal was precisely to stay inside the store and payment infrastructure.

Legal liability. When a customer's personal data sits on any of these sites, the LGPD (Brazil's data protection law) may require the incident to be reported. Confirm with legal before a case appears.

Cost. There is no public estimate of losses for this case and this text does not invent one. What can be said is the type of cost: investigation, rebuilding, changing passwords and keys, notifying customers and, if cards are involved, the card networks' rules.

Gain

The gain lies in a cheap defense: an inventory of everything that is online, with an owner and a deadline for fixes, costs more in organization than in money. Whoever does this before the next case saves time when someone calls to say "your site was mentioned in a news story".

Decision for the next 30 days

1. Ask IT and marketing for the list of all sites and subdomains online under your brand, including those hosted by vendors.
2. Ask which ones accept file uploads, have a login area or run outdated software.
3. Name an owner for each site and set a deadline for critical fixes. Shut down whatever is no longer in use.
4. Define who decides what in the first 24 hours of an attack.

Commercial application

• Vendor contracts. Whoever hosts or operates pages under your brand needs clauses on incident notice periods, software updates and access to records (logs). It is worth reviewing old contracts.
• Stores and payments. The largest group's stated goal was lasting access to stores and payment infrastructure. If you sell online, confirm with your payment provider that accounts and API keys are restricted and traceable.
• Competitive advantage. My opinion: showing customers and partners that there is an inventory and an owner for each page tends to weigh in vendor audits and in tenders that ask for security evidence.
• Brazilian context. According to a Mastercard study (Oct 20, 2026), 30% of the 200 Brazilian SMEs surveyed have no incident response plan and 33% slowed their pace of digital adoption. Small sample: it is a signal, not a portrait of the country.

Operational view: processes, people and routines

• An owner per page. Each site with a named owner and a contact at the vendor.
• Quarterly review. Review the list of sites and shut down what is no longer used. An unused site is risk with no benefit.
• Deadline for fixes. Critical flaws on public sites with a short, recorded deadline.
• First-24-hours plan. Who decides to take a site offline, who talks to customers, who calls legal and the insurer, if there is one.
• Vendors. Ask in writing how they protect what they operate for you and how quickly they notify you of an incident. The Cummins case shows the page may belong to a third party.
• Continuity. Know what stops if the online store or the support page goes down, and what the fallback procedure is.

Infrastructure view: cloud, network, servers and dependencies

• Exposure inventory. List domains, subdomains and public addresses, including those of vendors and old campaigns. Tools that scan your own attack surface help; NorForge found the Cairn dashboards with the same public tools (Shodan and Censys) an attacker would use.
• Isolation. Support or campaign sites kept apart from the ordering and payment systems, so that one compromise does not lead to the other.
• Secrets out of the code. Keys and passwords kept out of sites and repositories, and rotated regularly. In the dashboards, NorForge found hundreds of secrets and verified that about 11% were still valid.
• Restricted outbound traffic. Web servers that only talk to what they need get in the way of the second stage of almost every attack: downloading tools and opening a channel back out.
• Logs off the server. Send logs to a central system. If the intruder tampers with the server, the external copy preserves the history.
• Session and cache. In one of the documented cases, the agent used unauthorized writes to a session store (memcached). These services must not be reachable from outside the internal network.

Security view: prevent, detect and respond

Prevent

• Validate everything the user sends, especially files. Whoever does not need file uploads should turn the feature off.
• Update old software, plugins and frameworks, with an owner and a deadline.
• Web application firewall (WAF) in front of public sites.
• For those using Magento or Adobe Commerce: the coverage of the case (The Hacker News) cites the flaw CVE-2026-75650 ("StyleSmuggler"), with a test lab found in one of the agents' folders. There is no evidence it was used in these attacks. Affected versions: Adobe Commerce 2.4.4 to 2.4.9 and Magento Open Source 2.4.6 to 2.4.9; apply Adobe's hotfix. Check Adobe's advisory.

Detect

• Alert on new files in upload folders and hidden directories, and on unexpected upload forms, the door these agents looked for.
• Monitor file integrity on web servers (alert when something changes without an approved change).
• Watch the web server's outbound connections and spikes in login attempts or out-of-pattern requests.
• If your company runs its own AI agents: look for those agents' control dashboards exposed on the internet (the coverage cites port 8000 as common) and require a login on every dashboard.

Respond

1. Preserve evidence before acting: a copy of the server and the logs.
2. Isolate the site and restrict outbound network traffic.
3. Rebuild instead of cleaning, from a clean image.
4. Change credentials afterwards, once the fix is in, including API keys and database passwords.
5. Check the reach: did the access spread to other systems, such as the store and payments?
6. Notify customers, partners and, if personal data is involved, the authority under the LGPD, together with legal.

NoteThe recommendations in this section are general good practice, except the Magento one and the Cairn dashboard one, which come from the coverage of the case. Validate them with your security team.

Technology view: how it works inside

This section gives the technical detail, with the terms explained. The description comes from NorForge and the coverage; the plain-language explanation is ours.

Anatomy of three documented break-ins

NorForge describes cases in which the agents themselves explained the path. In three of them:

• Session, object and old framework. The agent managed to write without authorization to a session store (memcached, an in-memory cache that holds the logged-in user's state), put manipulated data there and exploited insecure deserialization of PHP objects together with a code chain ("gadget chain") in old Zend Framework components.
• A cookie that chooses the server. In one case, the agent found a single setting in a cookie that selected a vulnerable back-end server. NorForge validated this chain on its own.
• From dashboard to command. At another company, the agents found no flaw in the public application and then looked for a control panel connected to it. After hours of trial and error, they reported having tricked the server into running commands.

The terms

• SQL injection. The attacker types a database command into a field on the site (such as the login) and the site runs it.
• Unvalidated file upload. The site accepts any file. The attacker uploads a program disguised as an image and the server runs it.
• Web shell. A program hidden on a web server that accepts commands from outside. The uploader in this case is a discreet version: it only saves files.
• Insecure deserialization. The site rebuilds an object from data coming from outside without checking it; malformed data runs code.
• Authentication bypass. A flaw that lets someone in without the right password.
• Template injection (SSTI). The attacker inserts code into a page template, which the server runs.

What was in the toolbox

In a working folder that was exposed for a short time, NorForge saw tools such as Playwright and Chromium (to simulate a browser and test whether an order can be placed), PHPGGC (generates code chains for deserialization), Docker, Python 3, Nmap (maps ports), ffuf (discovers hidden directories) and OWASP Amass (maps a domain's attack surface). There was also a test lab for the Magento flaw cited above. What the report does not show is that flaw being used in the attacks.

A fact that helps defenders

What exposed the operation was the attacker's own carelessness: open dashboards. In those dashboards, NorForge also found tests on clients of apparently legitimate penetration-testing firms, which exposes those clients. InferenceThis applies to any company that uses AI agents, including for legitimate purposes: the control dashboard is a sensitive asset.

Context: not an isolated case

• Gambit Security (September): reported that a criminal used Cairn with two other AI tools to steal at least 600,000 card records from 25 companies. No source links that operation to the one in this article.
• Taiwan and India: Taiwan's government said in early 2026 that AI agents helped hackers break into its systems, and India's CERT-In agency said that agents in testing broke into real company systems (according to TNW's coverage).
• Brazil: CrowdStrike reports an 89% rise in attacks enabled by generative AI in the first half of 2026, and Netscout recorded 487,000 denial-of-service (DDoS) attacks in the country in the same period. Single-source data, used only as context. Links not checked.

A security vendor (7AI) also published an analysis of the case, arguing that open-weight models escape the refusal filters of hosted models. It is marketing copy from a product that competes with the problem, so we treat it as opinion, not fact.

For the general reader: what to do today

• Ask the head of IT: "Do we have a list of all the sites and pages online under our brand, including vendors' pages?"
• Ask: "Does any of them accept file uploads or run software that is out of date?"
• Ask each vendor, in writing, how it protects the pages it operates for you and how quickly it notifies you of an incident.
• Ask who decides what in the first 24 hours of an attack.

Terms in this article

AI agent

A program that receives a goal and works on its own until it is done, trying, failing and trying again.

Cairn

An open-source tool that organizes several AI agents around a target and a goal, with a shared board where they post what they discover.

Token

Unit of use of an AI model. The more tokens, the more expensive the use.

Web shell

A program hidden on a web server that accepts commands from outside and gives the intruder remote control.

Uploader

A page that only receives and saves uploaded files. In an attack, it is used to plant other programs later.

SQL injection

An attack that puts database commands into a field on the site.

Insecure deserialization

A flaw in which the site rebuilds objects from outside data without checking it.

Memcached

An in-memory cache service, used to hold session data and speed up sites.

WAF

Web application firewall: a filter in front of the site that blocks suspicious requests.

Exposed secret

A password, key or token left visible, for example in code or on an open dashboard.

LGPD

Lei Geral de Proteção de Dados, Brazil's personal data protection law.

Sources

Primary

• NorForge (Snorre Fagerland). "Inside Cairn: Open Windows into massive AI-Driven Cyber Operations", Oct 19, 2026: norforge.com/blog/inside_cairn

Journalistic

• Reuters (Raphael Satter), "How one hacker used AI agents and a few thousand dollars to break into scores of sites", Oct 19, 2026: reuters.com (link provided by third parties; text read via a reproduction)
• The Hacker News (Swati Khandelwal), Oct 20, 2026: Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
• The Next Web (Ana Maria Constantin), Oct 19, 2026: AI agents broke into 100+ sites for one hacker at $50 each, researcher says
• Cryptopolitan (Hannah Collymore), Oct 19, 2026: Exposed Cairn panels show criminals hunting cards, crypto and shell access

Context and opinion

• 7AI, "AI Agents Breached 100+ Companies for $50 Each" (vendor blog): blog.7ai.com
• DEV Community, summary of the case with source links: dev.to
• Mastercard, study on SMEs in Brazil (Oct 20, 2026); CrowdStrike, H1 2026 report; Netscout, DDoS threats in H1 2026. Links not checked.

Method note: the central numbers (1,200 sites, more than 100 companies, 23 hours, fewer than 100 characters, $5,000 in tokens) come from Reuters, checked against NorForge's report and the coverage by THN and TNW. The $50 cost and the 10% rate are estimates and are marked as such. I did not find relevant technical discussion on forums (Reddit, Hacker News) in this round. Pages read on Oct 21, 2026, partly through automatic summaries. Check the numbers in the sources before quoting them in a formal context.

Cross-check: where the sources differ

• $50 versus $5. Reuters speaks of about $50 per break-in ($5,000 in tokens in total); NorForge, of about $5 per task. The denominators are different (successes versus all tasks), and NorForge warns about the uncertainty.
• Success rate. NorForge speaks of about 10%, an approximation. Dividing 100 companies by 1,200 sites gives about 8%, but "companies reached" and "sites attempted" are not exactly the same measure.
• Countries. Reuters, via TNW, cites the US, Canada, Australia and Japan. NorForge, describing AIA0001, cites the US, Japan and Australia.
• AI tools. Reuters writes that the campaign "appeared to use" DeepSeek and Claude Code. NorForge writes that the worker "could mean" that. There is no confirmation.
• Who the hacker is. Reuters and THN speak of a Chinese-speaking hacker or criminal. NorForge assesses that the groups appear to be financially motivated, with no clear sign of government-linked activity.
• Dates. TNW and Cryptopolitan: Oct 19, 2026. THN: Oct 20, 2026. NorForge's report and the Reuters story are from Oct 19.

Final question

Which page at your company does nobody watch today? Reply by Instagram direct message to @techtraduzida and tell us how your team handles this point. If this content helped, follow the profile, like and share: it helps develop and spread the channel.