A $50 Breach, 1,200 Attempts, and One Operator Who Barely Showed Up

This campaign surfaced through a search engine, not a security operations centre.

For roughly two weeks from 2 October, Snorre Fagerland, a principal threat researcher at NorForge, ran Shodan and Censys queries looking for AI agent harnesses whose web interfaces had been left open to the internet. The most neglected was Cairn, an open-source problem-solving engine that hackers have adopted as an intrusion platform. From inside more than 20 exposed panels that NorForge assesses as likely malicious, Fagerland could read the target lists, the weaknesses the agents had found, the credentials they had harvested, and whether each break-in had worked.

The victims found out from Reuters. NorForge says it has been cooperating with the news agency to notify companies that appeared to have suffered a compromise, which suggests the warnings arrived from outside the victims' own telemetry.

What the wire service established is narrow and specific. A Chinese-speaking operator, running from 25 September, pointed agents at e-commerce sites in the US, Canada, Australia and Japan and broke into websites belonging to more than 100 companies. Deere, SharkNinja and Cummins were among them. Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed." SharkNinja said the intrusion hit a standalone site carrying only product support information and that it had contained the threat. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Reuters could not establish how much data, if any, was taken.

The instruction that set all of this going was fewer than 100 Chinese characters long.

Twenty-three hours, 140 facts, one cookie setting

Cairn is not a hacking tool in the way that phrase usually implies, and that is part of the problem. Its README describes a general-purpose state-space search engine: give it an origin and a goal, and worker agents write confirmed findings to a shared blackboard, declare what they intend to try next, and work outward. Penetration testing is simply the first domain it was validated on.

The repository has 3,896 stars, 684 forks, an AGPL licence and a commercial licensing contact in the footer. Its author's own results section records that the system finished third of 610 teams at Tencent Cloud's AI penetration testing challenge, solving all 54 problems, with the pipeline coming online for the first time at four in the morning on race day. The author, who posts as le1xia0, wrote on X that the platform was "not designed for hacking attacks" and that "if it is used to carry out harmful hacking attacks, that is not my intention." To The Verge, the same author put it as "misuse is a human decision, not a feature of the engine."

Both things are true at once, which is the awkward part of dual-use infrastructure. There is no version of taking that repository down that does not also remove a working red-team tool with nearly four thousand stars.

What the operator actually asked for is more revealing than the tool. A typical task, translated by NorForge, lists confirmed real shopping sites in four countries with traffic between 200,000 and 1.5 million, notes that Playwright has verified orders can be placed, and then sets the objective: find unauthenticated remote code execution. Priorities include login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass and account takeover. The payload to land is an uploader shell, "explicitly not a command-executing webshell."

That last clause is the one to sit with. A command-executing shell is loud, and it is what an intruder reaches for when the plan is to act now. A shell that only accepts uploaded files is quiet. NorForge's reading is that the aim was "persistent access to e-commerce/payment infrastructure for later monetization." The breach is the inventory. The theft comes later, if it comes at all.

NorForge measured the work. Among tasks that reached their goal in the busiest cluster, the average run was a little under 23 hours, generating an average of 140 recorded facts, with one project running past five days. Two cases were checked by hand rather than taken from the agent's own log. At a very large US retailer, a compromise NorForge says it validated, the agent "managed to find the one cookie setting that chose the vulnerable backend server." At a large hardware parts vendor, the shell URL recorded in a completed task served a live uploader when fetched.

The path into that vendor, according to the agent's own explanation, was unauthorised write access to a memcached session store, unsafe PHP object deserialization, and an exploitable gadget chain in legacy Zend Framework components. That list is a decade old.

The invoice

Here is where the story stops being familiar. Fagerland estimated the campaign consumed roughly $5,000 of tokens. Reuters reported that as about $50 per successful hack. NorForge's own estimate, which includes failed and early-ending projects, puts the average task at around $5, with unusually long projects above $100. The firm is explicit that "the uncertainty here is however considerable, and numbers could be off by a clear margin."

The two figures reconcile, and the arithmetic tells you what kind of number $50 is. Twelve hundred attempts at $5 each is $6,000. An average success rate of about 10% gives 120 wins. Six thousand divided by 120 is $50. Take Reuters' $5,000 and divide by "more than 100 companies" and you get $50 again. Two routes, same answer, which is the strongest thing that can be said for an estimate built on a token bill nobody itemised.

It is also not a full cost. The $5 average absorbs the 90% that failed, but the figure excludes the operator's time, the VPS and proxy infrastructure, and any value assigned to access once it is held. It is a metered inference bill and nothing else.

A second campaign gives a cross-check. Gambit Security's September interim report documented breaches at 25 companies and the theft of at least 600,000 credit card records, and its cost review averaged $25.46 across 101 completed scans. Different harness, different targets, same order of magnitude.

The direction of travel is not ambiguous. Bitsight's analysis of thousands of posts across 16 underground forums, covering February to August, found AI-related tradecraft discussion up 45% while ransomware mentions fell 49% and phishing fell 8.5%. Mentions of AI agents, the Model Context Protocol and indirect prompt injection rose 67%. A reseller calling itself CloseRouter advertised open-weights access at around ten cents per million tokens, with GLM listed at $0.053 per million input tokens against $1.12 from the official API.

Bitsight also documented the logical endpoint. A tool marketed as MONST3R-AI lets a buyer paste stolen OpenAI, Anthropic or Google keys into a panel, set a spending cap, and point the agent at a target list. The seller hosts no model. The safety training is bypassed architecturally, and the bill lands on whoever lost the key.

That is what happens next to a $50 breach. The marginal cost does not fall to zero. It gets charged to a stranger.

The target list was the product

Most intrusion campaigns begin with scanning and hope. This one began with a curated queue. Sites were ranked by traffic, then tested with Playwright, Microsoft's browser automation framework, to confirm that orders could actually be placed before the target was handed over for exploitation. A storefront that cannot transact is not worth five dollars.

The operator was not buying access to a website. He was buying a list of businesses that had already proved they take money over the internet, sorted by how much.

The operation was also, in places, comic. Across multiple panels, target domains had a leading "w" shaved off, turning wholesale into holesale and winter into inter, the signature of a shared domain normaliser with an off-by-one bug. That is how NorForge tied panels to the same operators. A criminal campaign running current models through a purpose-built agent harness was identified partly by a broken string function.

The attackers were not good at this either

NorForge's conclusion is not the one the industry usually reaches. "The attackers are not well prepared for this technology either," the report says. The panels were completely unprotected, exposing what looked like the full administrative interface: start and stop projects, inject data, redirect agents at new targets, restart old ones. NorForge did not test whether any of that worked without authorisation, and says so.

Trufflehog, run across the exposed panel data, found hundreds of secrets, 11% of them verified valid. One cluster exposed SSH logins to its own staging hosts inside its task briefs. Some operators were handing out the keys to their own infrastructure in the same document where they asked an autonomous agent to steal credit cards.

There is a supply-chain finding buried in that, and it does not only concern criminals. NorForge reports that a considerable number of apparently legitimate red team operations were exposed the same way, with client secrets sitting on open panels. If your company has commissioned a penetration test in the past year, that is now a reasonable question to ask your provider.

The uncomfortable symmetry is that this campaign was caught because its operators were careless. Nobody's detection engineering surfaced it. The next operator who closes the dashboard before pointing the agents at a target list is invisible to the same method, and there is no reason to assume the next one is less competent than this one. NorForge saw no obvious state-sponsored activity across the panels it assessed, and judged all of them financially motivated, with the sensible caveat that a state actor would presumably know how to secure a dashboard.

What a five-dollar probe does to your assumptions

On 9 October we looked at CrowdStrike's analysis of the Korean campaign and concluded that the AI had not opened a new kind of hole. It had lowered the cost of trying every ordinary one. The controls that mattered were per-record authentication, real sign-in on staff and partner paths, rate limits, and logs that would tell you within a day that a machine had been asking all night.

That holds. The exploit list in this campaign is almost nostalgic: SQL injection, unvalidated file upload, PHP deserialization, an authentication bypass, a gadget chain in a framework that should have been retired years ago.

What we underweighted was volume, and what volume does to patience. A human attacker with a budget has to choose. A pipeline that costs $5 a task and ranks candidates by revenue does not choose, it enumerates. Twenty-three hours of machine time with 140 notes and no memory of being bored is not a capability a person can match at any price worth paying, and it is now available at a price that does not require backing.

It also stretches the gap between compromise and consequence. An uploader shell sitting quietly in a support site is not a breach you detect by watching money leave. It is a breach you detect by looking at what your web root contains, which most companies do not do on a schedule.

We made a version of this argument on 4 October about remediation timelines, and again on 16 October about French grocery freezers running a patch more than a year old. This is the same lesson one layer up. The vulnerability is old, the search is new, and the search has become cheap enough to run against companies that assumed nobody would bother.

The question a security plan now has to answer is not whether someone would target you. It is what your internet-facing estate looks like to a machine with 23 hours, 140 notes and no instinct to give up.

At DMC we work with hardware and product companies whose edge is exactly this untidy: the dealer portal nobody owns, the spare-parts storefront marketing stood up in 2019, the support site a supplier hosts on your behalf, the ordering endpoint that answers strangers. Mapping that estate, deciding which parts genuinely need to take orders from the open internet, and moving the legacy stack underneath onto something supported is unglamorous work that rarely makes a board deck. A $50 breach is what makes it non-optional. If you cannot draw your external estate on a single page, let's talk.