One Hacker, 100 Breaches, $5,000 in Tokens: AI Crime Just Got Its Unit Economics

Published: October 20, 2026 | Reading Time: ~11 minutes | Channel: Technology

---

Five thousand dollars. That's the estimated total bill — in AI tokens, the raw compute commodity of our era — for a hacking campaign that breached the websites of more than 100 companies, including Deere, SharkNinja, and Cummins.¹

Sit with that number for a second. A single mid-tier penetration test for one company can cost more than that. The average enterprise spends multiples of $5,000 on cybersecurity before most people finish their morning coffee. And here, one person — who, by the way, typed fewer than 100 Chinese characters of actual instructions — outsourced an entire international intrusion campaign to AI agents and walked away with, conservatively, 100 compromised corporate websites.¹ ²

The researcher who watched it happen, Snorre Fagerland of the cybersecurity firm NorForge, has worked in this field for nearly three decades. His verdict: "It's a new world now."¹

He's right. And the uncomfortable part isn't the breach count. It's the invoice.

---

The Campaign That Ran Itself

Here's what actually happened, because the details matter more than the headline.

Beginning around October 2, Fagerland discovered roughly two dozen exposed instances of Cairn — an open-source AI problem-solving platform that chains AI agents together to pursue a goal step by step. Criminals had adopted it enthusiastically, and, in a display of operational security so bad it borders on performance art, they'd left the web dashboards wide open. Through those open panels, Fagerland could quietly watch the attackers work: targets, findings, stolen credentials, live progress bars.¹ ³

One Chinese-speaking operator stood out. NorForge links 14 of the exposed panels to this individual — labeled AIA0001 — carrying more than 1,100 attack projects between them.³ Starting September 25, this operator set AI agents loose on e-commerce websites in the United States, Canada, Australia, and Japan. By late last week, those agents had attempted to break into more than 1,200 sites and succeeded against more than 100.¹ ² ³

The victims Reuters identified include household names: Deere, the farm equipment giant; SharkNinja, the appliance maker; Cummins, the engine manufacturer. Two smaller businesses also confirmed compromises.¹

The human's total contribution? Instructions sketched out in fewer than 100 Chinese characters. An automated pipeline selected the targets — real shopping sites with 200,000 to 1.5 million visitors, each pre-validated with Microsoft's Playwright browser automation to confirm orders could actually go through. Then the machines went to work.³

The toolkit is the part that should make every CTO squint: the worker pipeline ran under the name claudecode_deepseek-v4.1-flash — which NorForge reads as Anthropic's Claude Code harness driving DeepSeek's V4.1 Flash model.³ American agent orchestration, Chinese model efficiency. The tools cost pennies per task and are available to anyone with a credit card.

---

By the Numbers: The Cheapest Invasion in Cyber History

Metric	Figure	Source
Websites targeted	1,200+ attempted	Reuters¹
Companies successfully breached	100+	Reuters¹
Total AI token spend (campaign)	~$5,000	Fagerland/NorForge¹
Cost per successful breach	~$50	Reuters¹
Instructions typed by the human	<100 Chinese characters	Reuters¹ ²
Average time per successful intrusion	~23 hours	Reuters¹ ²
Findings per successful project	~140	Technology.org³
Longest single operation	5+ days	Technology.org³
Exposed attacker panels observed	~2 dozen (14 tied to AIA0001)	Technology.org³
Attacker credentials leaked on their own dashboards	Hundreds — 11% verified still valid	Technology.org³
Sept precursor campaign (Gambit Security)	25 companies, 600,000+ card records, ~$25/target	Reuters¹ ³
August precursor (Gambit Security)	Russian-speaking crew used Cursor AI against 7 organizations	Reuters¹ ⁴

Look at the trend line across those last three rows, because the trajectory is the story. August: seven organizations, using an AI coding tool. September: 25 companies and 600,000 stolen card records at roughly $25 per target. October: 100+ companies at $50 a breach with the operator barely typing.¹ ³ ⁴

The cost per attack isn't rising. It's not even flat. The techniques are compounding monthly, and the price is rounding error.

One honest caveat, because we deal in data here: token-cost estimates depend on methodology. Fagerland pegged the campaign at about $5,000 total. NorForge's written estimate averages roughly $5 per task across all attempts — failures included — and warns the margin of error is wide.³ Either way, whether the true figure is $5,000 or a third of that, the conclusion doesn't change: the marginal cost of a serious cyberattack just collapsed to a rounding error.

---

How the Machines Actually Broke In

This is where Fagerland's "not script kiddie stuff" quote earns its keep.¹

The campaign's goal was remote code execution without logging in — and the standard play was to plant an "uploader shell": a bare file-upload form left on a compromised server as a persistent doorway. NorForge checked one of the claimed successes, on a hardware parts vendor's site, and found the shell still live.³

But the case that impressed the researcher was more revealing. On one large company, the agents failed to find any weakness in the public-facing application. A human attacker might have shrugged and moved to an easier target. Instead, the agents **pored through digital records to locate infrastructure associated with the target, found a public-facing control panel connected to it, discovered a subtle weakness in how that panel processed data, and — after hours of trial and error — reported tricking the server into executing malicious commands.**¹ ² ⁴

Fagerland's reaction: "It's not straightforward to come up with solutions like that."¹

Read that again. The agent did what good human pentesters do — it refused to accept the front door was locked and went looking for the side gate the facilities team forgot about. It didn't need creativity handed to it. It generated persistence, enumeration, and pivot tactics on its own, across a 23-hour average engagement, without coffee breaks or billing minimums.¹ ²

And it did this while its operator, by every indication available, was doing something else entirely.

---

Why "Regulate the AI Labs" Is the Wrong First Lesson

Here's where I'm going to lose the doom-posters, and I'm fine with that.

The reflexive take on this story is: see, frontier AI is dangerous, cap the labs. But look at the actual evidence. The breach vector wasn't a frontier model escaping a sandbox. It was:

1. Open-source tooling (Cairn) adopted from the public ecosystem
2. Forgotten vendor subdomains and control panels — the attack surface every company forgets it owns
3. Unpatched web apps with data-processing weaknesses a scanner-grade attacker could grind on for 23 hours
4. A victim list assembled by an automated pipeline targeting mid-size e-commerce traffic, not national infrastructure

The AI is the accelerant. The fuel was decade-old hygiene failures. Cummins is "investigating a potential cyber-attack on a website operated by one of our third-party vendors."¹ Third-party vendor. Deere reported remediation and "no indication that sensitive information was accessed." SharkNinja contained the threat to a standalone product-support site.¹ The machines, so far, are feasting on the neglected buffet, not the armored vault.

And here's the contrarian silver lining hiding in the data: the hackers were worse at security than their victims. The exposed Cairn dashboards leaked hundreds of credentials and keys — NorForge ran the Trufflehog scanner across them and verified 11% as still valid.³ The panels exposed full admin controls, meaning any stranger could have hijacked the attack fleets mid-operation. Criminal enterprises are rushing to adopt AI tooling they don't know how to operate, and their sloppiness is now an intelligence goldmine. That asymmetry — attacker infrastructure leaking faster than defender infrastructure — is the most exploitable fact in this entire story.

Also worth noting where the official response actually is: G7 finance leaders agreed last week to run drills against AI-driven cyberattacks,³ and Google DeepMind chief Demis Hassabis has described recent agent hacks as "early warning shots."¹ The people watching this closest aren't reaching for lab moratoriums. They're updating playbooks.

---

What This Means For You

If you run a business with any public-facing web presence — which is every business — here's the specific list, not the vague one:

1. Inventory every domain and subdomain you own, including vendor-operated ones — this week. The targets here weren't core platforms; they were support sites, parts vendors, and product-information pages.¹ Most companies can't list their own external attack surface from memory. Use an external attack-surface management scan and reconcile it against your asset register. Anything you can't attribute to a live owner gets decommissioned.

2. Assume 23-hour persistent grinding, not one-shot exploits. The agents averaged ~23 hours per success with ~140 findings per project.¹ ³ Your alerting should catch low-and-slow probing patterns across that window — a single afternoon SOC review won't see it. Tune detection for repeated failed enumeration on the same asset classes.

3. Rotate the keys nobody remembers issuing. NorForge found hundreds of credentials sitting on attacker dashboards with 11% still valid.³ Flip that lens: how many stale API keys, webhooks, and service tokens are live in your environment right now? Run a full credential audit quarterly and kill anything without an owner.

4. Add AI-agent language to your incident response and vendor contracts. Your response plan was written for humans — ransom notes, phishing emails, credential dumps. Add a section for machine-speed attacks: anomalous automated traffic, novel RCE patterns, and a vendor clause requiring breach notification within 24 hours (Cummins learned about its own exposure from a reporter-adjacent research disclosure¹ — don't let a third party's breach be your surprise).

5. Price the new baseline into your security budget. When the marginal attack costs ~$50, "we're too small to be a target" is dead. The target-selection pipeline here filtered for sites with 200,000–1.5 million monthly visitors — meaningfully-sized but hardly Fortune 500.³ If you fit that profile, assume you're in the pool.

---

⚠️ The Risks Nobody's Talking About

1. The token-price deflation makes this the cheap version. The $5,000 estimate uses today's model pricing.³ Model costs for this capability class keep falling — meaning the same campaign gets cheaper every quarter. Whatever deterrent math your board is doing, it's already stale.

2. The defenders' visibility here was an accident. NorForge only saw this campaign because the attacker left dashboards exposed.³ A marginally competent operator closes those panels, and the research community is blind again. Do not assume the next campaign will be observable, countable, or attributable.

3. The confirmed-impact numbers are likely understated. Reuters could not ascertain how much data was actually extracted,¹ and "other victims listed in the Cairn data did not return messages."¹ Two smaller businesses confirmed compromises.¹ The full blast radius is unknown — treat every "contained" statement as a snapshot, not a verdict.

4. Your own AI agents are the attack surface of the next headline. Bitsight reported last week that discussions about autonomous agents are surging across cybercriminal forums,¹ and Microsoft has already added agent controls in response to this breach wave.⁵ Every agentic tool your team deploys holds credentials of its own. The question this story makes urgent isn't "can agents be hacked" — it's "who pays when your agent gets redirected."

---

🎯 The Bottom Line

A single person breached 100+ companies for the price of a used laptop, and the most impressive thing the machines did was persist through a 23-hour grind that would exhaust a human team. The lesson isn't that AI is unstoppable — it's that attack economics have inverted while defense budgets still assume human-speed adversaries. Audit your forgotten subdomains, rotate your dead credentials, and write your incident plan for adversaries that don't sleep.

---

📚 Verified Sources

1. Reuters (via Honolulu Star-Advertiser) — "How one hacker used AI agents to break into over 100 company websites," by Raphael Satter, Oct 19, 2026. Core investigation: 100+ breaches, $5,000 token estimate, ~$50 per hack, <100-character instructions, Deere/SharkNinja/Cummins responses, Gambit Security and Bitsight context. https://www.staradvertiser.com/2026/10/19/breaking-news/how-one-hacker-used-ai-agents-to-break-into-over-100-company-websites/
2. Tom's Hardware — "A Chinese hacker used AI agents to break into more than 100 company websites," Oct 20, 2026. Confirms campaign details, targets, and Reuters findings. https://www.tomshardware.com/tech-industry/artificial-intelligence/a-chinese-hacker-used-ai-agents-to-break-into-more-than-100-company-websites-deere-and-sharkninja-among-websites-hit-by-open-source-ai-powered-problem-solving-platform-demo
3. Technology.org — "One Hacker's AI Agents Breached 100+ Websites," Oct 20, 2026. Adds NorForge detail: 14 panels linked to AIA0001, 1,100+ attack projects, Playwright target validation, uploader shells, ~140 findings/project, Trufflehog scan (11% valid creds), G7 drills, Hassabis quote. https://www.technology.org/2026/10/20/hacker-ai-agents-cairn-100-websites-deere-sharkninja-cummins/
4. WinBuzzer — "Hacker Leverages AI Agents to Breach More Than 100 Company Websites," by Markus Kasanmascheff, Oct 20, 2026. Confirms all core figures; adds Anthropic's Aug 2025 single-operator extortion disclosure (17+ orgs) and Nov 2025 report that AI performed 80–90% of an attack lifecycle. https://winbuzzer.com/2026/10/20/hacker-used-ai-agents-to-breach-100-plus-companies-websites-xcxwbn/
5. The Neuron — "Everything That Happened in AI Today, Tuesday, October 20," 2026. Context on Microsoft adding agent controls following the breach wave. https://www.theneuron.ai/digest/everything-that-happened-in-ai-today-tuesday-october-20-2026/

All claims verified against Gold-tier (Reuters) and Silver-tier (Tom's Hardware, Technology.org, WinBuzzer, The Neuron) sources. Each source URL was scraped and confirmed accessible with full content on October 20, 2026. Conflicting estimates (total token cost) are presented with both figures. Data-exfiltration scope remains publicly unknown and is labeled as such throughout.

---

The machines didn't break in through the front door. They broke in through the door you forgot you owned. 🎯