A campaign that attempted more than 1,200 websites and broke into over a hundred was not found by any of those twelve hundred sites. It was found because a researcher at NorForge was scanning the internet for exposed deployments of Cairn, an open-source agent platform, and walked into the operator's own unauthenticated dashboards — more than 1,100 attack projects, spread across fourteen consoles, driven by an instruction under a hundred Chinese characters long. The lesson defenders should take is not that agents attack cheaply, which was already true. It is that an attacker who automates acquires a control plane, and a control plane is an internet-facing asset with a self-written record of intent.
At a glance
Reuters published the investigation on 19 October 2026, built on NorForge's research. What is firm, and what is not.
| Detail | As reported | Confidence |
|---|---|---|
| How it was found | Internet-wide scanning for exposed Cairn deployments, by NorForge principal threat researcher Snorre Fagerland | Consistent across outlets |
| Scale | More than 1,200 sites attempted, over 100 breached; the most active cluster, tracked AIA0001, held 1,100+ attack projects across 14 dashboards | Consistent |
| Targets | Mostly e-commerce, in the US, Canada, Japan and Australia; Deere, SharkNinja and Cummins named | Consistent |
| The instruction | Fewer than 100 Chinese characters: get code execution, then plant an uploader web shell | Consistent |
| Cost | About $50 in tokens per successful intrusion, roughly $5,000 total; NorForge's own report instead gives ~$5 per task counting failures, and calls the uncertainty considerable | Estimates conflict, by design |
| Observed window | Malicious Cairn deployments from about 2 October; attempts reported as beginning 25 September | Single-outlet on the earlier date |
| Model and harness | Unconfirmed by Reuters; secondary accounts disagree on which model drove which harness | Unestablished |
| Data theft | Reuters could not determine whether data was taken; Deere reported no indication of sensitive data exposure, SharkNinja a standalone support site | Open |
The detection came from the attacker's side of the wire
Put the two vantage points next to each other and the asymmetry is the story. A targeted site saw what a targeted site always sees: some requests, maybe a parameter fuzzed, and — in the unlucky hundred — a file appear where no file should be. Nothing in that view says "campaign". There is no shared identifier across victims, the traffic is not voluminous enough to trip a rate limit, and an agent probing a web application looks like a scanner, which every site on the internet sees all day. One hundred separate incidents, correlated by nobody.
The operator's view was the opposite: one platform, fourteen dashboards, every target and every outcome in one place, reachable without a credential. NorForge verified a compromise at a large hardware parts vendor by finding the attacker's uploader shell still live — which is to say the confirmation also came from following the attacker's record rather than the victim's logs. The useful generalisation: for a campaign that runs on an agent platform, the highest-information observation point is the platform, and the platform is usually somebody's unhardened side project. Configuration as reconnaissance cuts in both directions, and this is the first large case where it cut toward the defender.
This is a genuinely new intelligence source, and it is worth naming as one: exposed agent control planes. Not the models, not the prompts, not the C2 of the last twenty years — the project list of a workflow tool somebody deployed without auth. Expect the next version of this campaign to put a password on it, and expect that to cost the operator almost nothing, which is why the finding is interesting rather than reassuring.
The instruction was 100 characters; the evidence was 1,100 projects
The single most quotable fact here is also the most instructive: the entire campaign was driven by an instruction shorter than this paragraph. Find a way to execute code on the target, then install an uploader shell. That is the whole of the human's contribution to the intent, and it is why the "AI-powered attack" framing misleads — nothing about the technique is new, and the model supplied no capability a competent operator lacked. What the model supplied was patience across 1,200 targets, which is the thing a human operator does not have.
Now look at what that trade cost the attacker. Delegating the breadth produced a durable, structured, timestamped record of every attempt: one project per target, outcomes attached, organised for the operator's own convenience. A human working 1,200 sites by hand leaves scattered bash history on a box nobody finds. An agent working 1,200 sites leaves a database. The campaign's legibility is a direct consequence of its scale, and the operator could not have had the scale without building the thing that made it legible.
That generalises further than this incident. Any party running agents at scale — attacker, enterprise, research lab — ends up with a control plane because a hundred concurrent runs cannot be managed without one, and the control plane is where intent, targets and outcomes are collected into one readable object. We have written about this from the defender's chair as agent inventory and registry. It turns out the obligation is symmetric; the attacker just has no compliance team to make him encrypt it.
The arithmetic, and the category it deletes
Take the two estimates seriously as estimates. Neither was read off a bill — NorForge had no access to the operator's token usage — and they differ by an order of magnitude because they divide by different denominators: $50 per success counts only the hundred that worked, while $5 per task counts every attempt including the eleven hundred that did not. Both are consistent with the same underlying spend; use either and the conclusion is the same, which is a good sign that the conclusion does not depend on the arithmetic.
The conclusion is that "not worth attacking" has stopped being a category. For twenty years the implicit defence of a mid-size e-commerce site was that a human attacker had better uses for an afternoon, and the cost that protected it was not the cost of the exploit — it was the cost of deciding whether the site was worth the exploit. That triage cost is what collapsed; we argued the general case in target selection just became free, and this is the first campaign to put a measured price on it. Note what did not change: the success rate is roughly one in twelve, and the technique was ordinary web application compromise. Nothing was defeated that patching would not have defeated.
The practical read for anyone who has ever deprioritised a vulnerability on the grounds that the asset is obscure: obscurity was a cost imposed on the attacker's attention, and attention is the input that just became abundant. Re-rank by exploitability, not by how interesting you think you are.
If you run agents, this is also a story about you
Strip out the crime and the architecture is a perfectly ordinary agent deployment: an open-source orchestration platform, a web console, a project per unit of work, credentials sitting in the environment, and no authentication in front of any of it because it was only ever meant to be reachable by its owner. That describes a large fraction of the agent infrastructure standing up inside companies right now, and it is the thing an internet-wide scanner finds.
- Your agent console is a production system, and it is the highest-value one you own. It holds the task list, the targets, the outputs, and usually the credentials the agents were handed. Compromise of a single agent is a blast-radius problem; compromise of the control plane is every agent at once, plus the record of what they did.
- Scanners find orchestration tools now. The same scanning that caught this operator finds your unauthenticated dashboard, and there is no reason to assume the next researcher to walk in is a researcher. Treat an agent platform's web UI as you would a CI server: authenticated, not internet-reachable, and inventoried.
- Credentials in the environment are credentials in the dashboard. If a project's configuration is readable, so is what it was given — see credential delivery to the sandbox for the shapes that survive this and the shapes that do not.
- Scheduled runs are the ones nobody watches. This campaign ran for weeks on unattended loops; so does most legitimate agent automation. Scheduled and triggered agents is where the unowned, unscored, unmonitored agents accumulate.
And for the defensive side of the ledger: the detection story that worked here was not behavioural analysis of inbound traffic, and it is worth being honest that behavioural detection would probably not have caught this at any single target. What does help is the unglamorous set — patch the web application, alarm on file creation in web roots, and treat an uploader appearing anywhere as an incident rather than a finding. Detecting agent compromise covers the trajectory signals for agents you run; for agents run against you, the signal is still the artifact they leave.
What to watch next
| If this repeats with… | What changes | What to do now |
|---|---|---|
| Authentication on the operator's console | The intelligence source closes; back to per-victim correlation | Do not build a detection strategy that depends on attacker misconfiguration |
| A higher success rate than one in twelve | The model, not the breadth, becomes the story | Track reported conversion rates, not totals — totals only measure spend |
| Post-exploitation delegated to the agent too | Dwell time drops below human response time | Rehearse containment that does not require a human in the first minutes |
| Rented agents instead of self-hosted ones | No exposed console to find at all | Push detection to the artifact and the egress, as in the rented-operator case |
FAQ
Did AI make this attack possible?
No — it made it affordable at width. The technique was ordinary web application compromise followed by a web shell, and the success rate of roughly one in twelve is what you would expect from unskilled breadth. What the agents contributed was the willingness to try 1,200 targets for a few thousand dollars.
How was the campaign actually discovered?
By scanning the internet for exposed deployments of the Cairn agent platform, not by any victim's monitoring. The researcher found the operator's own dashboards unauthenticated, with the project list, targets and outcomes visible.
Is $5,000 the real cost?
It is an inference, and the researchers say so. Token usage was never observed; the two published figures — about $50 per successful intrusion and about $5 per attempted task — divide the same guessed spend by different denominators. Treat the order of magnitude as the finding.
Which model was used?
Reuters could not confirm it, and the secondary accounts disagree. That is worth resisting as a focus: the campaign's shape would be unchanged by swapping the model, and the parts that are confirmed — the platform, the dashboards, the instruction, the funnel — are the parts that generalise.
What is the single highest-value fix for a site like the ones targeted?
Remove the code-execution path the agents were told to look for, and alarm on file creation in anything web-served. The agents found nothing exotic; they found unpatched applications, and then they wrote a file.
Further reading
On this wiki:
- Attacker-Operated Agents — the threat model for agents pointed at you rather than run by you.
- Configuration as Reconnaissance — why a deployment's own configuration is the most informative thing about it.
- Agent Inventory & Registry — the control plane as a register, from the defender's chair.
- The Lethal Trifecta — the conjunction that turns a compromised agent into an exfiltration channel.
- Target selection just became free — the general argument this campaign prices.
Sources:
- Reuters, 19 October 2026 — the original investigation.
- The Next Web — NorForge detail, the AIA0001 cluster and the cost estimates.