Autonomous AI Agents Hack Over 100 Websites: Hacker Spends $50 Per Breach

NorForge cybersecurity specialist Snorre Fagerland has discovered a series of cyberattacks executed almost entirely by autonomous artificial intelligence in the wild. According to his data, the attacker used the open-source AI platform Cairn to orchestrate a mass breach: after scanning the network, Fagerland found about two dozen unprotected instances of the platform and was able to track the criminal's actions in real time. Monitoring revealed that AI agents independently attacked more than 1,200 websites in the US, Canada, Australia, and Japan, resulting in the successful compromise of over 100 international companies.

Minimum Instructions, Maximum Autonomy

A key feature of the recorded campaign was the degree of human intervention. The attacker provided the artificial intelligence with brief instructions totaling fewer than 100 Chinese characters, describing the desired attack tactics. From there, the algorithms independently analyzed target systems, identified vulnerabilities, and executed penetrations without any direct operator involvement. According to Fagerland, this level of autonomy transforms a cyberattack from a craft requiring highly specialized skills into a process driven essentially by a single text prompt.

The Economics of the Attack: 23 Hours and $50 Per Site

NorForge analysts calculated the time and financial parameters of the campaign. On average, identifying vulnerabilities and breaching a single site took the AI agents about 23 hours. To execute the attacks, the criminal used a tandem of DeepSeek and Anthropic's Claude Code models. Total token expenses amounted to roughly $5,000, which, given the scale of successful hacks, yields an estimated cost of $50 per single breach. For comparison, hiring a qualified pentester for a similar scope of work costs exponentially more, and training an inexperienced hacker to the level required for such attacks takes months.

Unexpected Adaptability

NorForge specialists, in their own words, were struck by the algorithms' "high adaptability and ingenuity" when infiltrating systems. In one recorded case, the AI agents failed to find weaknesses in the external applications of a large company. Instead of stopping, the algorithms analyzed available digital records, discovered related infrastructure, found a hidden control panel, and used trial and error to force the server into executing malicious commands. Analysts emphasize that such actions require a deep understanding of system architecture and, prior to the advent of autonomous agents, would have been unavailable to inexperienced hackers without direct human intervention.

Not the First Time: From Cursor AI to 600,000 Leaked Cards

The campaign documented by NorForge is not an isolated precedent of AI tools being harnessed for cybercrime. Cybersecurity experts have previously documented the use of the Cursor AI system by Russian-speaking ransomware operators, as well as the leak of over 600,000 bank card records resulting from a similar AI-driven campaign. Together, these incidents point to a steady trend: autonomous and semi-structured AI agents are shifting from experimental tools to practical instruments of mass cybercrime, lowering the barrier to entry for attackers while simultaneously increasing the speed and scale of attacks.

Implications for Defense

Fagerland's discovery challenges the cybersecurity industry to revise its baseline assumptions. If an attack on corporate infrastructure can be launched with a 100-character text prompt and cost $50, traditional defense models designed for adversaries with limited resources and time require an overhaul. The openness of the Cairn platform and the presence of unprotected instances on the public network further exacerbate the problem, providing attackers with a ready-made infrastructure layer to deploy autonomous attacks without needing to develop their own tools.