Single Operator Used AI Agents to Breach Over 100 Companies at About $50 Each

Security researcher Snorre Fagerland of NorForge reported that one Chinese-speaking operator directed AI agents on the open-source Cairn platform to probe and breach websites, mainly e-commerce and payment-related sites in the US, Canada, Australia, and Japan. Reuters identified more than 100 breached companies among over 1,200 sites attempted, with the campaign starting around 25 September 2026. Researchers estimate total token spending near $5,000, or roughly $50 per successful breach at a success rate of about 10%. The agents were reportedly aimed at code execution and planting web shells for persistent access, and the activity became visible largely because many Cairn control panels were left publicly exposed. Reuters named John Deere, SharkNinja, and Cummins among affected parties, and the cost figures remain researcher estimates not confirmed by exact billing.