One hacker. $5,000. 100 company websites.

On 19 October 2026, Reuters and a security research firm called NorForge published the same story from two angles. NorForge's report, "Inside Cairn", describes how its researchers found something unusual. Reuters turned it into a news report with company responses.

Here is the core of it:

• The tool. Cairn is an open-source program that coordinates AI agents. You give it a goal, and agents work toward it step by step, sharing what they find on a common board. NorForge describes it as a penetration-testing framework, the kind of tool security teams use to test their own defenses.
• The operator. Reuters reported a Chinese-speaking hacker, working alone, who began on 25 September 2026.
• The targets. Mostly online shops in the United States, Canada, Australia and Japan. NorForge says the aim looked like lasting access to shops and payment systems, so the access could be sold or used later.
• The scale. The agents attempted more than 1,200 sites and got into websites belonging to more than 100 companies, according to Reuters.
• The instructions. Reuters said the operator's instructions were fewer than 100 Chinese characters. That is shorter than a text message.

NorForge found the activity because many people running Cairn left their control panels open on the public internet. Its researchers could read what the operators asked for and what the agents did. NorForge judged more than 20 of these panels likely malicious and split them into three groups. The biggest, a Chinese-language group, had more than 1,100 projects across 14 panels. NorForge says the activity looks financially motivated and that it saw no sign of a government link.

Companies that Reuters contacted described very different situations. One said it saw no sign that sensitive information was accessed. Another said the attack hit a separate product support site and was contained. A third said it was looking into a report of a possible attack on a website run by one of its vendors. We leave the names to the original reporting, because the details differ case by case and NorForge says most reported intrusions were not independently verified.

Break-ins on shop websites are not new. What is new is how little the attacker had to do.

NorForge's numbers show the pattern. Across the tools it observed, it estimates about 1 in 10 attempts succeeded. For the Chinese-language group's projects that reached their goal, the average was a little under 23 hours, with one project running more than five days. It also estimates an average cost of about $5 per task, including the failures, and said long projects could pass $100. Put the success rate and the cost together and you get roughly $50 per successful intrusion, which matches the figure the researcher gave Reuters.

Think about what that means for the economics. A 90% failure rate would sink a human attacker who is paid by the hour. It barely matters when the work is done by software that does not get tired and costs a few dollars a try. The attacker's real limit was no longer skill or time. It was how many sites he could point the agents at.

The methods themselves were not science fiction. In one case NorForge's researchers followed, the agent's own explanation pointed to a chain of three ordinary weaknesses: unauthorized write access to a session store, unsafe handling of data in PHP, and an old, unpatched framework component. NorForge notes this was one path among many. In another, an unauthenticated change to an account led to commands running on the server. The agents were also told to leave behind a small file-upload page, so the attacker could come back.

In other words, the agents found known kinds of weakness faster and cheaper than a person would, and then did it again on the next site. That is the part a small business should plan for.

A good rule with any breaking security story is to separate what was shown from what was claimed. Here is where the line sits today:

• How much data was taken. Reuters could not establish this. A break-in is not the same as a data theft, and the reported intrusions varied in what they touched.
• How many of the 100+ are fully confirmed. NorForge says it checked a small number itself, including a live upload page on a large vendor's site. Most were reported by the operator's own tools and panels.
• Who the operator is. Not identified.
• Which AI models did the work. NorForge's evidence only hints at the setup, so we do not name one. The risk does not depend on the brand.
• Exact costs. The $5,000 and $50 figures are estimates, as above.

Expect the picture to change as victims finish their investigations. We will update this page if the facts shift.

Picture a coffee roaster in Portland with an online shop, or a Berlin bike-parts store, or a Manchester accountant with a client portal. None of them can out-spend an automated attacker. What they can do is remove the easy ways in. Work through this list in order. Most items take an hour or less.

• List every site and tool you runInclude the old campaign site, the support portal, the staging copy and anything a vendor runs for you. Two of the three company responses in the reporting involved a side site or a vendor's site, not the main store.
• Patch the things that are actually being attackedStart with anything in CISA's Known Exploited Vulnerabilities Catalog that matches software you use. Update your shop platform, plugins, themes and server software, and retire anything no longer maintained.
• Close admin tools to the publicControl panels, database tools and anything with "admin" in its address should sit behind a VPN or an allow-list of IP addresses. NorForge found the campaign precisely because operators left panels open. Do not be the next example.
• Turn on multi-factor sign-in everywhereStart with admin accounts, hosting, email and your payment provider. CISA treats security keys as the strongest option and text-message codes as weaker, but says any multi-factor sign-in beats none.
• Keep session and cache services privateServices such as memcached or Redis should listen only on a private network, never on the open internet. In the case NorForge examined, write access to a session store was one link in the chain.
• Be careful with file uploadsLimit what file types your site accepts and where they are stored. Set an alert for new files appearing in web folders. A small upload page you did not write is a sign of a break-in.
• Ask your developer about unsafe deserializationIt is the name for a coding mistake where a site trusts data it should not. OWASP's cheat sheet explains it, and an experienced developer can check for it in an afternoon.
• Put a web application firewall in front of the shopA managed firewall from your host or CDN blocks many automated probes. It is not a fix for old code, but it buys time.
• Find and rotate exposed secretsNorForge's scan of the exposed panels found hundreds of secrets, and about 11% were still valid. Search your code and settings for stray passwords and API keys, and replace any that may have leaked.
• Keep backups you can restoreStore them off the server, keep several versions, and test a restore once. A backup you have never restored is a hope, not a plan.
• Watch for the quiet signsNew admin users, new files, odd outbound traffic and sudden spikes in failed logins. Many hosts offer these alerts for free.

Three things are worth taking from this story, whatever happens with the investigations.

First, speed matters more now. When a weakness is published, an agent can try it on a thousand sites before most owners have read the news. A patch routine that runs monthly may be too slow for the parts of your site that face the internet. Weekly checks for those parts are a reasonable aim.

Second, hiding in a crowd no longer works. Small businesses used to rely on being too minor for anyone to bother with. Automated attackers do not choose targets by name. They try everything cheaply and see what opens. In the NorForge data, the targeted shops had meaningful traffic, but the method does not need that.

Third, the same technology helps defenders. The tool at the center of the story was built for security testing, and teams use agents like it to find their own weak points first. If you run AI agents of your own, apply the same care to them. Their control panels, keys and permissions are now part of your attack surface. Our guide on giving agents access safely covers that side.