How a five thousand dollar AI army bypassed the security of one hundred global brands

I spent a late night last week reviewing packet captures from a colleague who works in incident response for a large logistics firm. The logs showed a series of unusual, persistent connection attempts that did not follow the standard patterns of a automated vulnerability scanner. They looked like a human was thinking, testing, and adapting in real time. We now know that this was not a human at all. It was an autonomous AI agent, and it was part of a campaign that compromised over 100 companies for roughly the price of a used hatchback.

Security researcher Snorre Fagerland of NorForge recently observed a Chinese-speaking threat actor who orchestrated this spree. The hacker did not write complex exploit code for each target. They instead used an open-source platform called Cairn to manage a fleet of AI agents. These agents spent weeks poking at the digital defenses of companies like Deere, SharkNinja, and Cummins. The result was a successful breach of approximately one out of every twelve targeted sites. The total cost for the attacker was about $5,000 in API tokens. That is $50 per successful intrusion into a major corporate network.

The architecture of a twenty-three hour intrusion

Traditional automated attacks rely on scripts that look for specific, known vulnerabilities. If a script searches for a missing patch and the patch is present, the attack stops. The campaign Fagerland observed functioned differently. The AI agents received terse instructions in Chinese, often fewer than 100 characters, outlining preferred tactics. From there, the agents operated with a high degree of autonomy.

When one of these agents targeted a large corporation, it first scanned public-facing applications. In one documented case, the agent failed to find any immediate weaknesses in the primary web application. A human script kiddie might have moved on to a different target. The AI agent did not. It began a systematic search of the company's associated digital infrastructure. It eventually located an obscure, public-facing control panel that the company likely forgot was active.

Behind the scenes, the agent spent hours in a cycle of trial and error. It identified a subtle flaw in how the control panel processed data. The agent then figured out how to leverage this flaw to trick the server into executing malicious commands. This was not a pre-written exploit. The agent developed the solution based on the specific environmental conditions it encountered. The average successful breach took about 23 hours of continuous, autonomous activity.

Economics of the automated exploit chain

The most alarming aspect of this campaign is the cost-to-benefit ratio. Cybersecurity has long been a game of asymmetric warfare, but AI agents have skewed the map. A traditional advanced persistent threat requires a team of skilled operators who command high salaries. This limits the number of targets a single group can pursue at once.

By using models like DeepSeek and Anthropic’s Claude Code through the Cairn platform, the hacker removed the need for a human team. The $5,000 investment covered the token costs for the LLMs to process information and generate code. This is a systemic shift in the threat landscape. A single individual with a few thousand dollars can now launch a sophisticated, multi-front campaign against hundreds of organizations simultaneously.

From a risk perspective, the network perimeter as an obsolete castle moat has never been more evident. Many of the victims, including SharkNinja and Cummins, noted that the breaches affected standalone sites or third-party vendor systems. These are often the softest points of an organization’s attack surface. The AI agents are specifically designed to find these weak links because they have the patience that human hackers lack.

Identifying the victims through exposed data

Fagerland discovered this activity because the hackers made a fundamental mistake. They left their instances of Cairn exposed to the public internet. This allowed the researcher to monitor the attackers as they worked. Through this oversight, Reuters was able to identify the specific victims by reviewing the activity logs within the Cairn platform.

Deere confirmed it took remediation actions after the incident. The company stated there was no evidence that sensitive information was accessed. SharkNinja reported that the hack hit a support site that contained only product information. Cummins is currently investigating a potential attack on a website managed by a third-party vendor. While these specific incidents may not have resulted in catastrophic data loss, they prove that the barrier to entry for complex intrusions is now at an all-time low.

Looking at the forensic evidence, other hackers used the same AI tools for different goals. One actor stole credit card data, while another attempted to breach a cryptocurrency exchange. The Chinese-speaking hacker was simply the most prolific. They launched agents against 1,200 sites across the United States, Canada, Australia, and Japan.

Defensive gaps in the third-party ecosystem

This spree highlights a massive gap in how companies manage their digital footprint. Most organizations focus their security budget on mission-critical servers and primary databases. However, the AI agents proved that a forgotten control panel on a third-party marketing site can be a gateway. Proactively speaking, security teams must treat every public-facing asset as a potential entry point for an autonomous agent.

In the event of a breach, the speed of the AI agent is a major factor. A human analyst in a Security Operations Center (SOC) might take hours to notice a series of subtle probes. An AI agent does not sleep and does not get distracted. It continues its trial-and-error process until it finds a way in or exhausts its budget.

Patching aside, the real issue is the logic of these systems. The AI agents used in these attacks did not always rely on known CVEs. They found logical flaws in how data was handled. This makes traditional signature-based detection less effective. We are entering an era where the attacker has a scalable, granular toolset that can think through security problems faster than a human defender can react.

Practical steps to harden the perimeter

The transition to agent-driven threats requires a shift toward a zero trust architecture. You cannot assume that a user or a system is safe just because it is inside the network or located on a known server. Every request must be verified.

Business leaders should prioritize the following actions to mitigate the risk of autonomous AI attacks:

• Audit the entire attack surface to identify and shut down forgotten or legacy control panels and standalone sites.
• Implement strict rate-limiting on all public-facing APIs and login pages to slow down the trial-and-error cycles of AI agents.
• Review third-party vendor security agreements to ensure that their sub-domains do not become a weak point for the parent organization.
• Use AI-driven defensive tools that can recognize the patterns of autonomous agents in real-time logs.
• Encrypt all sensitive data at rest to ensure that even a successful breach results in the theft of useless, unreadable information.

From an end-user perspective, the threat remains the same, but the volume is increasing. The hacker who used Cairn was able to move from one target to the next with almost zero friction. Consequently, the frequency of these attacks will likely grow as the cost of API tokens continues to drop. Security is no longer a checklist. It is a continuous process of monitoring for the unexpected.

Sources

• NorForge Principal Threat Researcher Snorre Fagerland, Technical Report on Cairn Platform Activity (October 2026)
• Reuters Investigative Report: AI-Driven Corporate Breaches (October 2026)
• MITRE ATT&CK Framework: T1588.006 (Obtain Capabilities: AI Models)
• NIST Special Publication 800-207 (Zero Trust Architecture)

Disclaimer

This article is for informational and educational purposes only. It does not replace a professional cybersecurity audit or incident response service. Always consult with a certified information security professional before making changes to your corporate network architecture.