About $50 per breach: inside the AI-agent campaigns that probed 1,200+ websites

For years, "AI-powered hacking" mostly meant better phishing emails. October 2026 brought two reports of something different: AI agents doing the actual intrusion work, chaining bugs and moving through networks while a human mostly watched.

One campaign was run by a cybercriminal and one by a state-linked group. Both are worth understanding, because the weaknesses they exploited are ordinary ones.

Campaign 1: one operator, 1,200 websites, about $50 per breach

On 19 October 2026, Reuters published an investigation based on research by Snorre Fagerland of NorForge. While scanning the internet for exposed copies of Cairn, an open-source AI agent platform built for problem-solving and authorised penetration testing, Fagerland found about two dozen instances being used maliciously. He spotted them from around 2 October.

What the panels showed:

• A Chinese-speaking operator gave agents short instructions, under 100 Chinese characters, and let them work on their own for hours.
• The campaign began around 25 September against e-commerce sites in the US, Canada, Australia and Japan. It had attempted more than 1,200 sites and reached sites belonging to more than 100 companies.
• Reuters identified victims including Deere, SharkNinja and Cummins by reviewing the panel activity. Deere said it saw no sign that sensitive information was accessed. SharkNinja said a standalone product-support site was hit and contained. Cummins said it was investigating a site run by a third-party vendor.
• Successful intrusions took about 23 hours. Fagerland estimated about $5,000 in model tokens in total, which works out to roughly $50 per successful hack.

What isn't confirmed: how much data, if any, was taken; the exact model mix (Fagerland estimated DeepSeek plus Claude Code); and the cost figures, which are estimates. Cairn's author said on X that the platform wasn't designed for attacks.

The Hacker News, reporting on NorForge's write-up, described one documented chain. The agent got write access to a memcached session store, combined it with unsafe deserialisation of PHP objects, and finished through old Zend Framework code. None of those are new bug classes. The agent's advantage was patience and scale, not novelty.

Campaign 2: a state-linked group with AI planner agents

On 30 October, The Hacker News reported on CrowdStrike research into Vapor Panda, a China-based intrusion group (formerly tracked as VexatiousTemper). It's using ARTEX, a Go-based AI penetration-testing framework that coordinates several LLM back-ends, DeepSeek among them.

According to CrowdStrike, as reported:

• Activity began on 17 October against more than 200 organisations: foreign ministries in several regions, US semiconductor, defence and think-tank organisations, and telecom providers.
• Post-exploitation was confirmed at nine organisations, where the attackers deployed a ShadowPad-derived backdoor.
• Planner and worker agents split the job from initial access to lateral movement, while a human operator supervised and stepped in, for example to get around endpoint defences.
• In one intrusion, the planning agents used on the order of 1.4 billion input tokens.

The techniques seen in the transcripts are revealing because they're mostly configuration and hygiene failures: an unsigned SAML assertion chained with an XXE flaw to reach a cloud metadata service, an unauthenticated orchestration service giving root in a container, readable LAPS passwords, and authentication keys not rotated since 2022.

What actually changed

Neither campaign used a new kind of vulnerability. What changed is the economics:

Before: skilled operator → hours per target → a handful of targets
After:  short instruction → agent works ~a day per target → hundreds in parallel
        cost per success: ~$50 in tokens (NorForge estimate)

When an attack costs tens of dollars and needs no expert time, long-tail targets become worth attacking: old storefronts, forgotten support sites and vendor-run microsites. These are exactly the sites in Campaign 1's victim list.

Who should care

• Anyone running an old web stack. PHP apps with legacy frameworks, exposed caches and admin panels are what the agents found.
• Companies with third-party sites carrying their brand. Two of the named victims pointed to standalone or vendor-run sites.
• Teams with long-lived secrets. NorForge found 11% of the secrets exposed on the panels were still valid, and Vapor Panda used keys unrotated since 2022.
• Anyone self-hosting AI agent platforms. Those exposed Cairn panels were also a liability for the people running them. NorForge noted that some legitimate pentest firms had real client tests sitting on open panels.

What developers and teams can do

1. Inventory everything internet-facing, including "temporary" sites, product-support portals and vendor-hosted pages. If agents can find it, it's in scope.
2. Patch and retire legacy frameworks. Unsupported Zend or old PHP isn't a backlog item any more.
3. Never expose caches or session stores (memcached, Redis) to the internet, and don't deserialise untrusted data.
4. Rotate secrets on a schedule and alert on unusually old keys. Prefer short-lived credentials.
5. Lock down cloud metadata access (IMDSv2 or equivalent) and audit SAML and XML parsing for XXE.
6. Watch for agent-like traffic: long, patient, methodical probing from a single source over many hours, which looks different from a quick scanner sweep.
7. If you run agent platforms yourselves, put them behind authentication, keep them off the public internet, and log what they do.

What might happen next (analysis)

This section is analysis, not reporting.

Expect more reports like these as researchers start hunting specifically for exposed agent control panels. Expect AI-tool vendors to face pressure to detect abusive use on their platforms; Fagerland's estimate that a mainstream coding agent was part of the mix will feed that debate. And expect defenders to answer with agents of their own, running continuous attack-surface scans and automated patching, because human-speed defence won't keep up with $50 intrusions.

Conclusion

The headline is "AI hacked 100 companies", but the lesson is older. Agents broke in through stale frameworks, exposed caches and unrotated keys. What AI changed is that every one of those weaknesses can now be found and used cheaply and at scale. The fixes are the same ones we've been putting off, but there's less time to do them.

Your turn: if an agent spent 23 patient hours on your oldest public-facing site, what would it find?

References

• Reuters via Honolulu Star-Advertiser, "How one hacker used AI agents to break into over 100 company websites" (19 Oct 2026): https://www.staradvertiser.com/2026/10/19/breaking-news/how-one-hacker-used-ai-agents-to-break-into-over-100-company-websites/
• The Hacker News, "Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites" (20 Oct 2026): https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html
• The Hacker News, "Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide" (30 Oct 2026): https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html

Part of The Wire, a daily brief on the tech and security news that matters to developers. Victim counts and costs come from researcher estimates and attacker records, as noted above.

☕ Enjoyed this post? You can support my writing on Ko-fi.