AI Agents Ran a 1,200-Site Intrusion Campaign for About $5,000 — Because Their Operator Forgot to Lock the Dashboard

Security researchers have documented what may be the clearest evidence yet that autonomous AI agents can run a real, end-to-end intrusion campaign at commodity prices — and they found it because the attackers left their own control panels open on the public internet.

In a report published October 19, 2026, Norwegian security firm NorForge describes discovering more than 20 exposed instances of Cairn, an open-source “general-purpose problem-solving engine” that can be pointed at a target and an objective, after which AI agents investigate the target, look for weaknesses, and attempt to break in. The panels, found via Shodan and Censys scans following a September Gambit Security report on criminal use of AI harnesses, gave NorForge an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities and establish persistent access (NorForge).

The campaign in numbers

The most active cluster, dubbed AIA0001, used Chinese-language tasking across 14 panels and ran more than 1,100 attack projects, targeting organizations mostly in the US, Japan, Australia and Canada — e-commerce and payment infrastructure, ranked by traffic and pre-validated with Playwright browser automation before being fed to the agents for exploitation. Reuters, whose exclusive the Techmeme roundup for October 19 summarizes as “a Chinese-speaking hacker used AI agents to target 1,200+ websites and breach 100+ entities, like Deere and SharkNinja, spending ~$5,000 in tokens,” identified victims including John Deere, SharkNinja and Cummins (Techmeme).

The Verge, relaying the Reuters reporting, adds the company responses: Deere said there is “no indication that sensitive information was accessed”; Cummins said it is “investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors”; SharkNinja said the breach hit a standalone product-support site and has been contained. The Verge also reports the attacker specified preferred intrusion tactics in fewer than 100 Chinese characters, and that successful breaches took about 23 hours (The Verge).

NorForge’s own measurements fill in the operational picture. Observed tasks ran on a worker named claudecode_deepseek-v4.1-flash — likely a Claude Code harness driving DeepSeek’s inexpensive 4.1 Flash model. NorForge estimates an average cost of roughly $5 per task including failures, with long-running projects (over 1,000 intents and facts) exceeding $100 — while cautioning the uncertainty is considerable. Across the campaigns it pegs the average success rate at about 10%, average time from project start to goal at a little under 23 hours, and about 140 facts per project (NorForge). Even at a 10% success rate, that economics — single-digit dollars per attempt against pre-validated, traffic-ranked target lists — is the story.

What the agents actually did

The tasking is blunt. A typical AIA0001 instruction, translated by NorForge, tells the agent these are confirmed real e-commerce sites with 200,000–1.5 million visits and asks it to find unauthenticated RCE — command execution, code injection, deserialization, file-upload webshells, SQL injection leading to RCE, SSTI or SSRF — and to land an uploader shell, explicitly not a command-executing webshell. NorForge independently verified at least one claimed intrusion by fetching the shell URL from a completed task against a large hardware-parts vendor; it served a live uploader webshell. That intrusion, per the agent’s own explanation, combined unauthorized write access to a memcached session store with unsafe PHP deserialization in legacy Zend Framework components. The one chain NorForge says it validated end to end is a different case: on a very large US retailer, the agent found the single cookie setting that routed requests to the vulnerable backend server.

NorForge also found a second high-confidence cluster (AIA0002, 10 English-language panels) aimed at financial theft, with tasking as sparse as “fetch credit cards” or “fetch crypto,” running DeepSeek models through the Pi coding-agent framework and OpenRouter.

The operator lesson: everyone’s dashboards are leaking

The ironic core of the report is that the attackers compromised their own operational security. The exposed panels revealed everything the agents discovered — including credentials harvested elsewhere — and a Trufflehog scan surfaced hundreds of secrets, 11% verified valid. The panels appeared to expose full administrative functionality: anyone who stumbled on them could potentially start, stop or redirect offensive agents. NorForge also found apparently legitimate red-team operations on unsecured panels, an exposure that hands clients’ vulnerabilities to anyone who looks.

For operators, the practical takeaways are concrete:

• Agent dashboards are privileged attack surface. Anything that can direct an agent with tool access needs authentication, network restrictions and audit logging — the same treatment you’d give a production admin console. This is the same class of failure as the stored API keys exposed in the OpenCode breach.
• Assume agent transcripts contain secrets. Facts, hints and harvested credentials sit in the project blackboard; treat harness logs as secret stores and scan them accordingly.
• Unattended offensive agents need containment. If a panel can redirect an autonomous agent with a webshell-deployment toolkit, the blast radius is the internet. Treat every agent as a privileged user and gate what it can reach, echoing CERT-In’s recent advisory on weaponized open-source agentic tools.

Cairn’s creator, who goes by @le1xia0, said earlier this month the platform “was never a ‘hacking tool’” and that “misuse is a human decision, not a feature of the engine,” per The Verge. NorForge says it is working to get the malicious panels taken down and cooperated with Reuters in notifying victims. The deeper signal for defenders is timing: models and harnesses evolve quickly, and a 10%-success autonomous campaign for pocket change is today’s snapshot, not the ceiling. The broader playbook for securing AI agents against prompt injection and least-privilege failures applies to defenders too.