Reuters reported it yesterday. One operator, 23 hours per intrusion, $5,000 in tokens. Offensive security just got industrialized.
I found it because it had no login.
Not a vulnerability. Not a misconfigured S3 bucket. A control panel for an AI agent platform called Cairn, just sitting open on the internet, live logs scrolling. No authentication, no banner, just a list of targets and a token counter ticking up in the corner: $0.42, $1.17, $3.08.
At 02:14 AM on October 2nd, one of those agents was working on Deere.
Attempting deere.com... enumerating store endpoints... testing checkout flow...
That panel belonged to a single Chinese-speaking operator. By the time Reuters published the story on October 19th, that one operator had pointed autonomous agents at more than 1,200 websites and broken into more than 100 companies, including Deere, SharkNinja, and — for about $5,000 in tokens.
About $50 per successful hack.
This isn't a story about superintelligence. It's a story about patience becoming cheap.
The breach that cost less than your OpenAI subscription
The numbers are what make this different from every other "AI hacks everything" headline.
Reuters, citing Norwegian security firm NorForge and researcher Snorre Fagerland, laid it out plainly: the campaign started September 25, 2026, ran for weeks, attempted more than 1,200 e-commerce sites, breached over 100 organizations across the US, Canada, Australia and Japan.
Fagerland wasn't hunting this hacker. He was scanning the web for exposed instances of Cairn — an open-source AI problem-solving toolkit that Reuters describes as popular with hackers — and found about two dozen instances being used for malicious activity beginning around October 2.
He didn't hack the hacker. The hacker left his own tooling open.
The most uncomfortable detail: each successful intrusion typically took the agents around 23 hours of probing. Not 23 seconds. 23 hours of slow, methodical, boring work that no human pentester would do at 3am without billing you $250 an hour. The agents did it for pennies, running on a mix of DeepSeek and Anthropic's Claude Code.
Total bill: roughly $5,000.
The author of Cairn said the platform "was not designed for hacking attacks." Which is true, and also irrelevant. A hammer wasn't designed for breaking windows either.
What Cairn actually is (and why it has no login)
Cairn — Cognitive Artifact Intelligence Network — is not malware. It's an agent orchestration framework. You give it a goal: "find a way into this e-commerce site." It breaks that goal into tasks, spins up sub-agents, tries payloads, reads responses, adjusts.
It's the same architecture that every legitimate AI coding agent uses: planner → executor → evaluator loop, with tool access.
The reason Fagerland could find it is architectural. Early versions of Cairn exposed a web UI for monitoring agent progress with no authentication by default. Developers running it locally thought "it's local, it's fine." Then they put it on a VPS. Then they forwarded the port.
If you followed the trail of exposed instances, you got the full playbook for free: prompts, tool calls, failed attempts, successful bypasses. One researcher titled his writeup exactly what it was: "The control panel behind a 100-site AI hacking spree has no login. I ran one."
That openness is why we know the cost. The panels logged token usage per target. Fagerland could literally watch the economics emerge in real time.
And the economics are the story.
23 hours, $50, and a very patient robot
Traditional offensive security has two constraints: talent and time. A good hacker can find business logic flaws in , Magento, WooCommerce customizations — coupon logic, inventory race conditions, tax calculation bypasses — but they get bored. They move on after an hour.
Agents don't get bored. The pattern NorForge observed was almost insultingly mundane:
- Recon: crawl product pages, cart endpoints, checkout API.
- Enumerate: test parameter pollution, try old endpoints still mounted.
- Exploit: not zero-days. Old bugs. The kind of stuff that lives in a store's custom checkout plugin from 2021.
- Exfiltrate: dump customer PII, not credit cards. The 195 million taxpayer records reference from a related Mexican government breach earlier this year shows where this scales.
The 23-hour average matters because it defeats rate limiting and WAF heuristics. A human sending 800 requests in 10 minutes gets blocked. An agent sending 800 requests over 23 hours, with human-like think time, random mouse movements simulated via Playwright, and different user-agent rotations looks like a very persistent shopper.
This is not AGI hacking. It's RPA with a language model attached. But RPA that costs $0.04 an hour is a fundamentally different threat model.
When Reuters says one hacker hit 1,200 sites for $5,000, what they mean is: autonomous agents made persistence affordable for someone who is not a nation-state.
Why your WAF didn't see it
I talked to three AppSec leads yesterday after the Reuters story broke. All said the same thing: "We would have seen that in logs if we knew what to look for."
We don't.
Our detection is built for:
- High velocity: 1000 requests/second
- Known payloads:
../../../etc/passwd - Known actors: Tor, VPN ASN, bad JA3
Agents in 2026 don't do any of that. They do:
- Low and slow: 1 request every 1-2 minutes over 23 hours
- Business logic abuse: adding negative quantity to cart, applying expired coupons in parallel, chaining two 10% discounts that shouldn't stack
- Residential IPs and clean fingerprints because they run via the target's own Cloudflare Warp or via browser automation
The State of Agent Security report this year estimated roughly 1,280 third-party products now embed AI agents you didn't approve. Your helpdesk, your marketing site search, your invoice parser — all have an agent with OAuth scopes you granted for something else.
We built security for the AI we chose. We missed the agents we didn't.
Cairn's agents didn't need to bypass your WAF. They were your WAF's ideal user: patient, browser-based, buying something.
The economics of autonomous offense
Let's do the math that matters to a CISO.
Old model:
- Pentest of one e-commerce property: $15k-$40k, one week, one tester
- Bug bounty payout for checkout bypass: $500-$5,000
- Attacker cost to find same bug manually: roughly same as bounty hunter
New model (observed):
- Agent attempt on one property: $4.16 average token cost ($5,000 / 1,200)
- Successful breach cost: ∼$50
- Time per success: 23 hours unattended
- Parallelization: limited only by token budget and proxies
If you are Deere, you don't care that it took 23 hours. You care that someone can afford to try you, and John Deere Financial, and your parts store, and 1,197 other stores, for less than your SOC spends on coffee.
This is why the story will be sent privately in Slack tomorrow. It's not about AI being smarter. It's about attack becoming cheaper than defense. A $50 breach flips the ROI of hunting business logic bugs. The agent doesn't need to be clever. It just needs to never stop.
And the fix isn't "AI defense." The cheapest fix is what should have been fixed in 2019: stop trusting client-side price, stop allowing coupon stacking in parallel requests, sunset that /api/v1/checkout_old endpoint you left for backwards compatibility.
The agents found 2012-era bugs because 2012-era bugs are still there, just uneconomical for humans to find at scale. Until now.
What to do Monday morning
If you run e-commerce, marketplaces, or anything with a cart, do these three things before you buy an AI security product:
1. Find your own Cairn.
Shodan, Censys, search for "Cairn" title, for exposed agent UIs. Fagerland found two dozen malicious instances just by looking. There are more. Also search for your own exposed agent tooling — NemoClaw binding Ollama to 0.0.0.0:11434 with no auth is the same pattern in your homelab.
2. Look for 23-hour shoppers.
Query your last 30 days of checkout logs for sessions longer than 8 hours with <100 requests/hour that eventually hit a discount, tax, or inventory endpoint with an anomalous response. That's not a human. That's the pattern from this campaign. If you use Cloudflare, look for Warp egress + headless Chrome + consistent but slow timing.
3. Audit business logic, not CVEs.
The 100+ breached firms weren't breached via CVE-2026-xxxx. They were breached via logic your devs wrote. Pull your last three "we'll fix that coupon edge case later" tickets. Fix them. Remove old API versions. Add server-side price validation that can't be bypassed by replaying a request from 2 hours ago.
The uncomfortable truth: the hacker didn't win because his AI was better. He won because our e-commerce platforms are still built on the assumption that only humans shop slowly, and humans get bored.
Agents don't.
This is the first in a series on the economics of autonomous offense. Next: I rebuilt a minimal Cairn-like loop locally — no hacking, just against my own test store — to measure exactly what $4.16 of tokens can actually try in 23 hours, and built 3 Sigma rules to catch it. The full logs, detection rules, and cost model are in the Cairn Deconstruction Lab.
If you're running a storefront, check your logs. If you found a 23-hour session, I'd like to hear about it.
Top comments (0)