AI Agents Breached 100+ Company Websites for About $50 Each: What Site Owners Should Check

On 19 October 2026, Reuters reported that a Chinese-speaking hacker had used autonomous AI agents to break into websites belonging to more than 100 companies, at an estimated cost of about $50 in AI usage per successful break-in. The researcher who found the operation, Snorre Fagerland of NorForge, saw it only because the attacker left agent control panels open on the internet. The story matters beyond the big names involved: if the work is that cheap, small sites will be probed too. This post sets out what was reported and a checklist for your own site.

Key takeaways

Reuters and NorForge report that AI agents tried more than 1,200 sites and reached more than 100 companies, mostly online shops in the US, Canada, Australia and Japan.
The cost figures (about $5,000 in total, about $50 per success, about 23 hours per success) are estimates: NorForge says it had no actual token-usage data.
The agents reportedly went around well-defended front doors and found side entrances: related servers, control panels, upload forms and old code.
Basic hygiene is the defence: remove unused panels, lock down uploads, patch old frameworks, rotate exposed keys.
Patching the hole does not remove a web shell that is already installed.

Table of Contents

What was reported

According to the coverage of NorForge’s findings, the campaign began on 25 September. Fagerland found more than 20 exposed control panels of Cairn, an open-source tool for running teams of AI agents, which he judged were being used for attacks. The panels showed targets, discovered weaknesses and credentials. The Cairn author told Reuters the tool was not designed for hacking.

Claim	What the reports say	How firm it is
Scale	More than 1,200 sites targeted; sites of more than 100 companies reached	1,200 is targeting scope; 100 is Reuters’ breach count and not every case was independently verified
Victims named	Deere, SharkNinja, Cummins, plus two smaller businesses	Deere reported remediation and no sign sensitive data was accessed; SharkNinja said a standalone support site was affected; Cummins said it was investigating a vendor-run site
Speed and cost	About 23 hours and about $50 per success; about $5,000 overall	Estimates; NorForge had no token-usage data
Success rate	Roughly one in ten observed tasks reached its goal	Not a general AI hacking success rate
Models	Reportedly DeepSeek and Claude Code	Not confirmed by NorForge or Reuters
Data taken	Unknown	Reuters says the full damage remains unclear

Three-step flow of the AI agent intrusion campaign: short brief, hours of probing, then an upload form or web shell foothold — Reported pattern: the agents went around the front door.

How the agents got in

The most useful detail is the route, not the tools. In one reported case the agents found no weakness in a large company’s main application, so they searched for related infrastructure, found a public control panel and, after hours of trial and error, got a server to run commands. In another, NorForge confirmed that an upload form accepted a file that combined an image signature with PHP code, and that a cookie decided which backend server handled the request. Only one backend ran the file as PHP.

One agent also described a longer chain involving a memcached session store, unsafe handling of serialized PHP objects and old Zend Framework code. NorForge could confirm only that the upload form was live, so treat that chain as the agent’s own account.

What to check on your own site

NorForge’s write-ups do not give a formal checklist for site owners. What follows is my own reading of what they describe, in rough priority order.

Find forgotten panels. List every admin page, dashboard, staging site and test tool that is reachable from the internet. Remove what you do not use and put the rest behind a login, a VPN or an IP allowlist.
Lock down uploads. Allow only the file types you need, store uploads outside the web root or in storage that cannot run code, and check that your uploads folder cannot execute PHP.
Look for files you did not put there. Check upload and hidden folders for unexpected forms or scripts. If you find a web shell, keep a copy of the logs and files before you clean up. Patching the original hole does not remove it.
Patch old code. Make a list of frameworks, plugins and themes more than a year behind and update or retire them.
Check every server behind your load balancer or CDN. One node with a looser setting was enough in the reported retailer case.
Rotate keys that may have leaked. Closing a panel does not cancel keys that were already copied. Search repositories for secrets with a scanner such as Trufflehog.
Ask your vendors. Cummins said the possible attack involved a vendor-run website. Your support portals and hosted shops count as your attack surface.
Watch for slow, persistent probing. Successful runs took about a day. Rate limits and alerts on repeated failed requests help catch it.

If you run automations, the same ideas apply to your workflow tools. See our security checklist for anyone running automations for the agent-specific steps. Businesses in India should also remember that CERT-In’s 2022 directions require specified cyber incidents to be reported within six hours.

This post reports journalism and security research as published and is not a substitute for a professional security review. Several details are estimates or come from the attackers’ own tooling, and I have marked them as such.

Sources

Frequently asked questions

How did AI agents break into more than 100 company websites?

According to NorForge and Reuters, an operator gave short instructions to teams of AI agents that spent hours probing targets. They reportedly found side entrances such as exposed control panels, file-upload forms and old code, and used them to run commands on servers.

How much did the AI agent attacks cost?

NorForge estimates about $5,000 in AI usage in total, or about $50 per successful break-in, with about 23 hours per success. These are estimates, because NorForge had no actual token-usage data.

What should a small website owner do first?

Find and remove or protect any admin panel or staging site you do not need, make sure your upload folders cannot run code, update old plugins and frameworks, and rotate any keys that may have been exposed.