I was staring at a dashboard feed when the alerts stacked up, one after another. You feel the quiet first — a single operator, a fleet of AI agents, and a cursor that never blinks. It hit me like a violinist conducting an army.
More than 100 websites — businesses big and small across the United States, Canada, Australia, and Japan — were compromised over the last few weeks, according to a Reuters summary of a new report by cybersecurity firm NorForge. What reads like a syndicate was, the researchers say, one Chinese-speaking hacker using an orchestration layer called Cairn to task AI agents to find and exploit weak points.
I noticed exposed panels that should have been locked.
NorForge found dozens of Cairn dashboards left publicly reachable. When an orchestration panel is open, you don’t just see outcomes — you watch the conversation: prompts, responses, retries. Those logs showed the hacker issuing commands that were sometimes fewer than 100 Chinese characters long. Some prompts amounted to nothing fancier than “fetch credit cards” or “fetch crypto.”
The agents acted fast. The campaign launched around September 25 and targeted roughly 1,200 sites; about 10% returned successful breaches — north of a hundred victims. The underlying language models in play were reportedly a blend of China’s DeepSeek and Anthropic’s Claude Code, all coordinated through Cairn. NorForge estimates the entire operation cost about $5,000 (≈ €4,600) in tokens — roughly $50 (≈ €46) per successful breach.
I watched one incident escalate from a scan to full remote execution.
A NorForge researcher replayed a case where an agent scanned public records, found an admin-facing control panel, and then crafted an exploit that convinced the server to run rogue commands. This was not a blunt-force script-kiddie probe. The agents chained reconnaissance, privilege probing, exploit crafting, and exfiltration — each step guided by prompts and automated decision logic.
How did one hacker use AI agents to hack hundreds of sites?
Short prompts, repeated at scale, routed through a multi-agent framework like Cairn can automate the full pen-test-to-payload loop. Cairn handles state, subtask assignment, and retries. The hacker provides high-level objectives; the agents handle the legwork. Because many operators left panels exposed, defenders could watch the exact instructions sent to models such as DeepSeek and Claude Code.
I compared this to more familiar forms of cybercrime and felt the gap widening.
Traditional attacks often require a human to tune exploits, chain steps, and manage scraping. Here, AI agents did that orchestration. The researcher who built Cairn, known on X as @le1xia0, posted that Cairn was not designed for harmful attacks, but the design made misuse trivial when combined with exposed infrastructure and permissive models.
Can AI agents replace human hackers?
They can perform many tasks humans used to do manually: reconnaissance, exploit generation, and lateral movement scripting. They don’t fully replace human creativity yet, but they lower the bar enough that a lone operator can run a campaign at scale. I tell you this because the economics change fast: a few thousand dollars’ worth of tokens can buy reach and persistence.
I traced where defenders can actually push back.
Look at the weak links: exposed admin panels, unpatched control interfaces, and stale credentials. Those are the entry points Cairn agents exploited. Companies should harden authentication, monitor admin endpoints for unusual queries, and treat orchestration logs as first-class telemetry. Tools and platforms that matter here include GitHub for code, Cairn for orchestration, Anthropic and DeepSeek for models, and NorForge and Reuters for threat intelligence.
I’ve seen AI accelerate tasks in many industries. Here it’s being used like a craftsman turning a cathedral out of a single handheld drill; the skill isn’t always in the tool, it’s in how the tool is pointed. The question becomes less about whether AI can help attack and more about how rapidly defenders can raise the cost of doing so.
We can watch panels and interrupt campaigns, but the real lesson is organizational: assume the scripts will be written by a machine and the prompts by a person. The next breach might be quieter, faster, and cheaper than you think — are your defenses ready to answer a single operator with an army of agents?