djinn six icon
djinn six®

The Sixth Layer

← Back to blog
AI Security

$50 a breach! What one hacker's AI agents mean for how we test

Allen Clark

Allen Clark

$50 a breach! What one hacker's AI agents mean for how we test

Back in February, the International AI Safety Report 2026 gave us a measured verdict on AI-driven hacking. It stated that AI was already helping attackers with many steps and at least one real-world intrusion had been semi-autonomous, with humans stepping in only at critical decision points. On the rest, it was pretty clear,

"Fully autonomous end-to-end attacks, however, have not been reported."

In the research they reviewed, agents ran irrelevant commands, lost track of where they were and could not recover from simple errors without any human interactions.

Eight months later a security researcher spent a fortnight watching AI agents break into more than 100 company websites for a single attacker who did almost none of the work.

That gap, from "not reported" to "watched happening" in under a year, is the story here and so is the remarkable acceleration in capability behind it, changing what a security test needs to tell you.

What happened

On 19th October Snorre Fagerland, principal threat researcher at the Norwegian firm NorForge, published "Inside Cairn" and Reuters reported it the same day. Cairn is an open-source AI problem-solving platform where you give it a goal and it runs teams of AI agents until the goal is met. Its author says it was not designed for hacking.

While scanning the internet, Fagerland found more than 20 Cairn control panels that criminals had left exposed. By examining them he could see, in real time, what the agents were told to do and what they actually did. NorForge then grouped all this activity into three specific clusters.

  1. Chinese-speaking operator targeting e-commerce and payment sites in the US, Japan, Australia and Canada
  2. English-speaking operator out for money specifically looking for credit card details and crypto wallets
  3. English-speaking operator targeting small e-commerce sites and some very large US platforms

The largest belonged to the first of those clusters, the Chinese speaking operator. According to the report and Reuters:

  • The instructions were quite terse. Reuters says they set out the preferred tactics in fewer than 100 Chinese characters. They centred on finding a way to run code on the server without logging in, starting with the usual suspects such as SQL injection, unauthenticated endpoints, file uploads and authentication bypass.
  • The agents ran more than 1,100 attack projects. NorForge puts the average success rate across the campaigns it saw at around 10% and in the examples it shows, success meant planting a persistent backdoor for later use.
  • A successful intrusion took a little under 23 hours on average.
  • NorForge estimates the cost at around $5 per attempt in AI usage, including the attempts that ended early. Reuters puts it at about $50 for each successful break-in. The report is candid that the estimate is uncertain and "could be off by a clear margin."

Reuters independently reviewed the activity and identified some victims, including well-known manufacturers. Some said the affected site was standalone or run by a third party and Reuters could not establish whether data was taken. I've left the names out on purpose: the point here is the method, not who was unlucky.

How they got in

What impressed Fagerland most was not the volume but the persistence. In one case the agents found nothing wrong with a large company's public-facing application. So they went looking for infrastructure connected to it, found a control panel exposed to the internet, spotted a subtle weakness in how it processed data and after hours of trial and error, used it to run their own commands on the server. Fagerland told Reuters:

"It's not script kiddie stuff."

Effectively these agents were mimicking the kind of route a skilled human penetration tester takes on a good day. The difference is that the agents do it for hundreds of targets at once, never get bored and cost about as much per success as a decent lunch.

It isn't an isolated case

A month earlier, on 22nd September, the Israeli firm Gambit Security described a campaign in which a single Chinese-writing operator used three open-source agent tools, including Cairn, to breach at least 27 companies and copy more than 600,000 still-valid payment card records. Gambit put the AI cost at about $25 per target.

Two independent researchers, two operators, the same pattern. All it took was a handful of instructions, agents doing the work and economics that make patience almost free.

Things worth noting in these studies

These caveats need to be taken into account and deserve to be called out.

  • These are vendor reports. NorForge and Gambit are security companies publishing their own findings. Reuters checked parts of the NorForge activity itself, which helps, but the figures are theirs.
  • "No human" is not quite right. Cairn lets an operator add hints as a project runs. What the evidence shows is that the human effort per breach has collapsed, not that it has disappeared.
  • The cost figures are estimates. NorForge says as much.

None of that weakens the conclusion. If anything, a true understanding of the situation makes it a little more uncomfortable, this was not a nation state with a lab, it was individuals with an open-source tool and a credit card.

What it means for testing

  1. Your attack surface is whatever can be linked to you. The agents in the clearest example ignored the hardened front door and went round the side. A test scoped to just the application can pass while the forgotten admin panel on a neighbouring host is the way in. Tests need to be scoped by what an attacker can connect to you and not by just what is on the change request.
  2. Patience is now cheap. Many defences are tuned, whether consciously or not, to the effort a human will spend before moving on. An agent that spends 23 hours on one target for $50 resets that assumption. You need to be asking of every control: would this still hold after a day of tireless, well-informed attempts?
  3. A point-in-time pass is a snapshot, not an assurance. In my last article I discussed that pass or fail is not enough on its own anymore. Here we now have a further reason: the economics of it all. When an attacker can try a thousand doors for the price of a laptop, your last quarter's clean security report says very little about how you are positioned this morning. Testing has to become continuous and it has to be measured against what attackers can now afford to do.
  4. Agent tooling is attack surface too. It may not have gone unnoticed but there is an irony at the centre of this story, the researchers could only watch because the criminals had left their own agent control panels open to the internet, along with hundreds of secrets, of which NorForge found 11% were still valid. Any organisation adopting agents, be that for defence or for anything else, should treat their consoles, credentials and permissions as crown jewels. The NCSC's guidance in Managing the cyber risk of agentic AI from August 2026 is a good place to start. Decide how much autonomy each agent really needs, run it in a robust sandbox, then log, audit and monitor what it does.

The same tools cut both ways

The truth here, though, is that the techniques in these reports are available to defenders as well. The question for every security team and every regulator assessing one is no longer whether AI agents can attack at scale. It is whether your testing is keeping pace with what they can now do for $50.

Sources

← More insights from djinn six
    $50 a breach! What one hacker's AI agents mean for how we test | djinn six