Fifty dollars. That’s roughly what it cost one hacker in AI tokens to break into a company website, and the attacker barely had to type to do it.
According to a report on NorForge’s findings, researcher Snorre Fagerland found a Chinese-speaking operator who handed an intrusion campaign to AI agents. They tried more than 1,200 sites in the US, Canada, Australia and Japan and got into over 100. Fagerland puts the bill at about $5,000, with each successful break-in taking around 23 hours.
How the campaign worked
The tool is Cairn, an open-source framework that gives an AI agent a starting point and a goal, then lets it work step by step. Operators often leave its web interface unprotected, and that’s how Fagerland found about two dozen malicious panels. NorForge ties 14 of them to a group it calls AIA0001, with more than 1,100 attack projects.
The human input was tiny. Instructions ran under 100 Chinese characters. An automated pipeline picked real shopping sites with 200,000 to 1.5 million visitors and used Microsoft’s Playwright to confirm orders could go through. The agents then aimed for unauthenticated remote code execution and planted file-upload shells. NorForge verified one claimed success on a hardware vendor’s site.
The worker name suggests Anthropic’s Claude Code harness driving DeepSeek’s V4.1 Flash model. That pairing matters. A premium agent scaffold plus a cheap model is exactly the cost profile that makes this scalable for criminals.
Who was hit
Journalists identified victims including Deere, SharkNinja and Cummins. Deere said it saw no sign sensitive information was accessed. SharkNinja said the affected site held product support content and the threat was contained. Cummins said a third-party vendor’s site was involved. Two smaller businesses also confirmed compromises. How much data was taken is still unknown.
The cost figures need a caveat. NorForge’s own estimate averages about $5 per task across all attempts, failures included, and admits a wide margin of error.
Why it matters
This isn’t the first time. Gambit Security described a September campaign chaining Strix, Cairn and Hermes that hit at least 27 organizations at about $25 a target. Earlier this year, other reports covered ransomware crews using Cursor and agents operating without human oversight. The pattern is clear: off-the-shelf agent tooling is now good enough for mass exploitation.
The irony is that the attackers were sloppy. Their dashboards exposed targets, stolen credentials and live progress, and a Trufflehog scan found hundreds of keys, 11% verified valid. Fagerland had assumed agents would need a human watching. They didn’t.
For defenders, the advice is dull but now urgent: patch exposed web apps, rotate leaked keys, and have a breach plan ready. Third-party vendor sites are the soft spot here. G7 finance leaders have agreed to run drills on AI-driven attacks. That’s useful, but the economics already favor the attacker. This is signal, not noise.
