The $50 Break-In: Autonomous AI Hacking Has Arrived
Bottom line up front: A single Chinese-speaking criminal pointed a swarm of AI agents at more than 1,200 corporate websites this fall and walked away with persistent access to more than 100 of them, including sites tied to Deere, SharkNinja, and Cummins. The human wrote fewer than 100 characters of instructions. The agents did the rest, around the clock, at an estimated cost of about $50 per successful intrusion. The same week, the Department of Homeland Security disclosed an order removing DeepSeek, the model family behind the campaign, from every federal civilian agency. The age of autonomous, low-cost cyber intrusion is no longer a forecast. It is a line item.
What Happened
Snorre Fagerland, a principal threat researcher at the security firm NorForge, was scanning the internet in early October for exposed copies of Cairn, an open-source "problem-solving engine" that coordinates AI agents toward a defined goal. He found more than 20 control panels that he assessed as likely malicious, left wide open by their operators with no password at all.
What those panels revealed, in NorForge's October 19 report and a Reuters exclusive the same day, was a window into a new kind of criminal operation:
Scale. The most active cluster ran more than 1,100 attack projects across 14 dashboards, targeting online retailers in the United States, Japan, Australia, and Canada with between 200,000 and 1.5 million monthly visitors.
Autonomy. Operators handed the agents a short instruction and walked away. Successful intrusions took a little under 23 hours of unattended probing, and the agents documented roughly 140 discrete findings per project along the way.
Objective. The goal was not data theft on day one. It was persistence. The agents were told to plant a quiet file-uploader web shell and stop. NorForge verified one such shell live on a large hardware vendor's site. The attacker can return at any time and escalate.
Cost. Fagerland estimated to Reuters that the entire run consumed about $5,000 in AI tokens, or roughly $50 per breach. NorForge cautions that this figure carries considerable uncertainty.
The reported victims described limited damage. Deere said there was no indication sensitive information was accessed. SharkNinja said a standalone product-support site was hit and contained. Cummins said it is investigating a report involving a third-party vendor's site. Reuters could not establish how much data, if any, was taken.
"The agents did not need a zero-day. They needed patience, cheap compute, and a target that had not patched its web stack. Most organizations have all three waiting."
The Model Behind the Machine
Several headlines got this wrong. NorForge found that every task in the main cluster was run by a worker named "claudecode_deepseek-v4.1-flash." That naming suggests an orchestration harness borrowed from Anthropic's Claude Code, with the actual reasoning performed by DeepSeek 4.1 Flash, an inexpensive Chinese open-weight model released in September. Claude Code was the steering wheel. DeepSeek was the engine.
That detail connects directly to Washington. On October 20, the Federal Register published a DHS order, signed July 24 under the Federal Acquisition Supply Chain Security Act, directing all federal civilian agencies to remove DeepSeek products and any third-party product "developed using DeepSeek implementations," and barring future purchases. The order cites the transfer of sensitive data to China and the possibility that the models contain malware or vulnerabilities. It does not define "DeepSeek implementations," which leaves every federal vendor guessing.
The policy question is unavoidable. Cheap, capable, open-weight models are now the attacker's preferred tool precisely because no one can revoke their access. A closed model can refuse to help a criminal. An open model downloaded last month cannot.
The Uncomfortable Lesson for Defenders
Three facts from this campaign should reshape how leaders think about risk.
The entry points were old. The agents exploited SQL injection, insecure file uploads, unsafe deserialization, and legacy framework components. What changed is that an attacker can now afford to test every one of these doors on every site, continuously, for the price of a dinner.
The side doors were the main doors. Two of the three named victims were compromised through standalone support sites or third-party vendor platforms, not their core infrastructure. Your attack surface is every system that carries your name, including the ones you forgot you had.
The defender's own AI may refuse to fight. During a separate agentic attack on the coding platform OpenCode this month, the company's defensive AI model began declining requests mid-incident because the activity resembled offensive hacking. Guardrails designed to stop criminals can also stop the people trying to stop criminals.
"The threat actor's biggest operational failure was not getting caught. It was leaving the keys to a fleet of autonomous hackers on an open web page for anyone to find."
An Analyst's View
This campaign does not introduce a new vulnerability. It removes the labor constraint that used to protect the long tail of organizations from skilled attention.
For a decade, mid-sized companies, county agencies, school districts, and regional hospitals have lived under an unspoken assumption: we are too small to be worth a skilled attacker's time. That assumption is now false. An agent does not prioritize. It enumerates. If your organization is on a list of 1,200 and you are reachable, you will be probed with the same persistence as the Fortune 500 company above you.
For national security practitioners, the second-order issue is sovereign capacity. The United States is simultaneously banning a Chinese model from its own networks and watching that same model power intrusions against American companies from abroad. Export controls do not reach a file that has already been downloaded. The realistic response is not prohibition. It is building domestic defensive AI capacity that is permitted to act with the same autonomy the attackers already enjoy, inside clear legal and ethical boundaries.
The honest counterargument deserves a hearing. NorForge found no evidence of state-sponsored activity among the exposed panels, and a sophisticated state actor would never leave a dashboard open. The criminals here were amateurs with excellent tools. That is exactly the point. The tools are now good enough that amateurs can do what required professionals three years ago.
What Leaders Should Do Now
Inventory every internet-facing asset that carries your brand, including vendor-hosted and legacy sites, and patch the web application layer first.
Treat third-party and supplier platforms as part of your own perimeter, with contractual security obligations and verification.
If you serve federal civilian agencies, audit your product stack for any DeepSeek dependency now, before an agency asks.
Confirm with your AI vendor in advance that defensive tools will be permitted to operate during an active incident.
Assume you are already on someone's list.
How OSRS Can Help
OGUN Security Research and Strategic Consulting LLC helps organizations see themselves the way an autonomous adversary does. Our team conducts external attack-surface assessments, vendor and third-party due diligence investigations, and AI governance advisory for public agencies and private firms navigating orders like the DHS DeepSeek directive. Contact us at contact@ogunsecurity.com to schedule a confidential consultation.
Intelligence. Protection. Strategy. www.ogunsecurity.com
About the Author
Dr. Sunday Oludare Ogunlana, Founder and CEO of OGUN Security Research and Strategic Consulting LLC, Professor of Cybersecurity, national security scholar, and television commentator.
Enjoyed this article? Share it with a colleague who manages risk, and subscribe to our email list for weekly intelligence briefs. Stay informed by following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
Comments