Written By | Torch Media Africa
A Chinese-speaking attacker pointed robot hackers at 1,200 online shops from John Deere to SharkNinja, and the whole spree cost about the price of a used laptop
Search
SCIENCE & TECH
Imagine hiring a burglar who never sleeps, never complains, works for about fifty dollars a break-in and takes his orders in a few dozen words. Now imagine that burglar is not a person at all, but a swarm of software agents that can be pointed at 1,200 shopfronts at once. That is no longer a thriller plot. According to a security report published on Monday, it is what one hacker just did.
Researchers at the security firm NorForge say a Chinese-speaking attacker used autonomous AI agents to go after more than 1,200 online stores and successfully break into more than 100 of them. Reuters, which independently identified some of the victims, named household industrial brands: farm-machinery giant Deere, kitchen-gadget maker SharkNinja and engine maker Cummins. The bill for the entire adventure, by one researcher's rough estimate, was about $5,000 in AI usage fees.
"It's not script kiddie stuff," NorForge principal threat researcher Snorre Fagerland told Reuters. "The development in this field is astounding."
The robot burglars come off the leash
For years, security experts have warned that AI would one day let criminals work at industrial scale. This week that warning stopped being theoretical. The campaign, which NorForge says began on 25 September, did not rely on a brilliant new exploit or a leaked cyberweapon. It relied on an open-source tool called Cairn.
Cairn describes itself as a general-purpose problem-solving engine. A user sets a target and a goal, and a team of AI agents works toward it step by step, posting what they find to a shared board that every agent can read. Human operators set the mission and can nudge the agents with hints along the way. Cairn's author, who posts online as le1xia0, says it was never designed for hacking. "If it is used to carry out harmful hacking attacks, that is not my intention," he wrote on X.
Whatever the intent, the tool proved to be a very capable accomplice. Reporting on the NorForge findings says the attacker's preferred intrusion tactics were written in fewer than 100 Chinese characters. In plain terms: a short paragraph of instructions, and the machines did the rest.
How the spree worked
NorForge says the attacker built an automated pipeline. Agents were handed a target, told to find a way to run code on the site, and then asked to plant an uploader web shell, a small hidden doorway that lets an intruder walk back in whenever they like. The targets were online shops in the United States, Canada, Japan and Australia, with traffic of roughly 200,000 to 1.5 million visitors.
The goal, NorForge believes, was lasting access to the shops and their payment systems. The firm confirmed at least one live web shell at a large hardware parts vendor. Successful break-ins took just under 23 hours of automated effort on average. That is slow by Hollywood standards, but it is also entirely hands-off. While the human slept or ate dinner, the agents kept grinding.
Researchers sorted the exposed Cairn control panels they found into three clusters. The biggest, a Chinese-language cluster, spanned more than 1,100 projects across 14 panels and was judged with high confidence to be malicious. An English-language cluster of 10 panels appeared aimed at stealing credit cards and cryptocurrency. A third, single-panel cluster with 59 projects was assessed with low confidence. NorForge put the average success rate at around 10 percent, while warning that the clusters had different goals and cannot be neatly compared.
The numbers that should worry you
The headline figure is the price. Fagerland estimated about $5,000 in AI tokens for the whole campaign, or roughly $50 per successful hack. NorForge's own report is more cautious, putting the average cost at about $5 per task, including failed or abandoned attempts, and admitting the uncertainty is considerable. Either way, the economics are the story. A decade ago, breaking into a hundred company websites meant a skilled crew and months of work. Now it can mean one person with a prepaid account.
The tools themselves are a patchwork of cheap and powerful. One worker in the exposed data was labelled "claudecode_deepseek-v4.1-flash", which may point to Anthropic's Claude Code coding agent running on DeepSeek's low-cost V4.1 Flash model. That is an inference from the name, not a confirmed finding.
And the attackers were sloppy. Many operators left their Cairn control panels open to the public internet, where NorForge found them with ordinary internet-scanning tools starting around 2 October. Inside were hundreds of credentials, API keys and other secrets. A secrets-scanning tool called Trufflehog verified about 11 percent of them as still valid. Some legitimate security-testing firms had also left client work sitting in exposed panels.
The big names caught in the net
Reuters tied the campaign to three well-known companies. Each response was carefully lawyered.
Deere said it had taken remediation steps and saw no indication that sensitive information was accessed. SharkNinja said the attack hit a standalone product-support website and had been contained. Cummins said it was investigating a potential attack on a website operated by one of its third-party vendors. Reuters could not establish how much data, if anything, was taken, and the identity of the attacker is unknown. It is not even confirmed whether one person or a team was involved.
One measured caveat: the full details of the intrusions have not been independently verified beyond the researchers' findings and Reuters' reporting, and several of the key figures, including the cost per hack and the success rate, are estimates.
Not the first time
The Monday report did not come out of nowhere. In a report published on 22 September, security firm Gambit Security described a separate operation in which an attacker used three open-source AI agent frameworks to breach at least 27 companies and steal more than 600,000 credit card records. Gambit recovered the attacker's staging server and rebuilt the campaign from its logs.
According to Gambit, a penetration-testing tool called Strix scanned for weaknesses, Cairn carried out attacks from start to finish, and a third agent called Hermes ran the show, armed with 121 skills, 78 of them offensive. The human behind it typed 1,951 prompts across 260 sessions. Gambit counted card skimmers at 19 named victims and on more than 100 other websites, with 79 percent of the stolen cards belonging to US cardholders. Victims included a Fortune 500 hospitality company, a major US airline and an online wine shop where a scheduled job reinstalled the skimmer every two minutes. At a bicycle retailer, the agents wiped 180 database tables, including the victim's own backups.
Gambit estimated a completed scan cost an average of $25.46. "Where access was achieved, it usually took less than a day, and in many cases just a few hours," wrote Eyal Sela, the firm's director of threat intelligence.
Governments are noticing. Reporting on the NorForge findings notes that Taiwan's government has said AI agents helped hackers break into its systems, and India's cyber agency has said AI agents under testing broke into firms' live systems.
Why this changes the game
Security people like to say that defenders have to be right every time, while attackers only need to be right once. AI agents tilt that equation further. They do not get bored. They do not need a big salary. And, crucially, they do not need much skill from the person giving the orders.
Fagerland said he had assumed hacking agents would still need at least some human supervision. The NorForge evidence suggests otherwise: agents were given goals, left alone and returned with working footholds. The barrier to entry, once measured in years of training, is now measured in a credit card and a paragraph of text.
That does not mean the sky is falling. A roughly 10 percent success rate means roughly nine in ten attempts failed. The targets were mostly smaller online shops, not hardened bank vaults. And the very same technology can be used by defenders to find holes first. But the direction of travel is clear, and the speed is the unsettling part.
Expert perspective
The researchers' message is less about panic and more about housekeeping. Fagerland's team is working with Reuters to warn victims and is asking hosting firms to take the exposed control panels offline. The irony is that the operators' own carelessness, leaving control panels open to the world, is what exposed them: criminals make the same security mistakes as everyone else.
Security commentators have been blunter. Reporting on the case quotes one framing that agentic AI has "collapsed the cost and skill barrier" to large-scale intrusion. Whether or not that turns out to be an exaggeration, it is hard to argue with the underlying arithmetic.
What this means for you
If you shop online, the practical risk is the same as it has always been, just more frequent. Small and mid-sized shops are exactly the sort of target a cheap, tireless robot can work through by the hundred, and your card details are the prize.
Use a credit card rather than a debit card online, since your liability and your cash flow are better protected. Turn on transaction alerts so you spot odd charges within hours, not weeks. Prefer payment methods that hide your real card number, such as digital wallets. Use a unique password for every shop, and change it if a retailer you use reports a breach.
If you run a business or a website, the advice from the researchers and commentators is plain. Check whether any self-hosted AI agent platform, Cairn included, is reachable from the public internet without a password. Treat AI agents like any other sensitive infrastructure: require authentication, limit what they can reach, and keep logs good enough to spot long, automated probing. Do not leave API keys and credentials lying around in tools that might leak.
The bottom line
One person, a few thousand dollars and a handful of open-source tools. That is all it took, apparently, to knock on more than 1,200 doors and get inside over a hundred of them. The Cairn campaign is not the end of the internet, and much of its damage is still unknown. But it is a vivid preview of an era in which the hardest part of cybercrime is no longer the hacking. It is deciding who to hack next.
The tech industry now has a simple, uncomfortable job: close the doors before the robots find them. The robots, after all, work for fifty bucks a break-in, and they are not going home.
