AI agents hacking websites: Cairn panels show a 10% hit rate at about $5 a task

AI agents are being used to break into websites at scale, and an October 19, 2026 investigation shows what it looks like from the inside. Security firm NorForge found more than 20 exposed control panels for Cairn, an AI penetration-testing platform, that it judged likely malicious. Reuters, working with NorForge, traced one campaign to a Chinese-speaking hacker whose agents tried more than 1,200 sites and reached over 100 companies.

What NorForge found

NorForge published its write-up on October 19, 2026. It says the panels it judged likely malicious fall into three clusters. The largest, which it labels AIA0001, ran 14 Chinese-language panels and accounted for more than 1,100 attack projects. A second cluster, AIA0002, ran 10 English-language panels aimed at financial theft: cards, crypto, merchant payments and pharmacy sites. A third cluster with one panel is rated low confidence. NorForge believes all three were financially motivated and sees no obvious state sponsor.

The panels had no apparent access control. That is how researchers could watch the agents at work, and it is also why the operators' own findings, targets and harvested credentials were visible to anyone who found them. NorForge ran a secrets scanner over the exposed material and found hundreds of secrets, about 11% of which were verified as valid. It withheld the panel addresses until takedowns are complete.

How the agents work together

Cairn organizes work as projects. Each has an origin and a goal. Agents alternate between intents, meaning planned next actions, and facts, meaning discoveries, and post the facts to a shared blackboard that every agent can read. A human operator can drop hints onto the same blackboard, including credentials harvested elsewhere.

AIA0001 fed the system automatically. Target sites were ranked by traffic, checked with a browser automation tool, and then queued as tasks. Targets drew 200,000 to 1.5 million visits each.

The cost, and why the number matters

NorForge says average success was about 10% of tasks, with many more reaching partial goals or collecting information for later attempts. Successful AIA0001 projects took just under 23 hours from start to goal and logged about 140 facts. One project ran for more than five days.

On cost, NorForge estimates an average task at around $5, including the failures, and says long projects with more than 1,000 intents and facts could pass $100. It flags the estimate as uncertain. Researcher Snorre Fagerland, NorForge's principal threat researcher, gave Reuters a different cut of the same idea: a successful intrusion took roughly 23 hours and about $50 in AI tokens, and the whole campaign perhaps $5,000. NorForge had no actual token-usage data, so treat both as rough.

The point is not that $50 is cheap in absolute terms. It is that a human attacker's hours were replaced by a loop that runs unattended, and Reuters reports the hacker's instructions were fewer than 100 Chinese characters.

Which models, and what is not confirmed

The AIA0001 worker was named claudecode_deepseek-v4.1-flash. NorForge suggests that could be a Claude Code harness driving a DeepSeek model, and says it is not confirmed. The AIA0002 workers were named in a way that points to the Pi coding-agent framework using DeepSeek models through OpenRouter. No model is named for the third cluster. A worker name is a label an operator chose, not proof of what was running, so no lab should be blamed on this evidence alone.

NorForge also found what look like legitimate red-team operations exposed the same way, which is its own lesson: the tool is dual use and its operators were careless.

The victims

Reuters named Deere, SharkNinja and Cummins among affected companies. Deere told Reuters it saw no indication that sensitive information was accessed. SharkNinja said a standalone product-support website was affected and the threat was contained. Cummins said it is investigating a possible attack on a vendor-operated website. The campaign began September 25 and focused on e-commerce sites in the US, Canada, Australia and Japan. The extent of data theft is unclear, because an exposed panel can show a compromise without showing what was taken.

Per Reuters, Cairn's author said the platform was not designed for hacking attacks and that harmful use was not their intention. That is a claim about intent, and the open-source release made it easy to use as it was used.

Where this sits in the race

This is the unglamorous end of the capability story. Epoch AI's October 16 data insight puts open-weight models 6 to 7 months behind closed models in cyber capability, with Z.ai's GLM-5.3 the leading open model on its Cyber ECI. A 10% success rate with cheap open-weight models is a business, because the failures cost cents. Our earlier coverage of Anthropic's frontier red team on self-replicating AI covers the worry that capability will keep spreading; this campaign shows the version that has already arrived, without any frontier model required.

It also lands on a live legal question. The AI Agent Accountability Act would put criminal liability on people who deploy agents that hack. An anonymous operator abroad is exactly the case where deterrence on paper does little.

Our take

Defenders should assume automated, patient, low-cost probing of every public web property, especially e-commerce platforms, and patch the boring things first. Tool authors should treat an admin panel with no login as a security bug in their own product. And everyone should hold the model-attribution claims loosely until NorForge or the labs confirm them. The numbers here, a 10% hit rate, about $5 a task, 23 hours to a win, are estimates from one firm's snapshot, and NorForge says it may already be outdated.