AI Agents Tried to Break Into More Than 1,200 Websites, Mostly Online Shops. What a Small Business Site Should Check.

On 19 October the security firm NorForge published research on a hacking campaign run with AI agents, and Reuters reported it the same day. A single Chinese-speaking hacker had pointed a team of agents at websites and let them work. By late last week, according to Reuters, the agents had tried to break into more than 1,200 sites. Most were online shops. Three companies were named: Deere, SharkNinja and Cummins.

This is not a story about a clever new attack. It is a story about the price of an old one dropping to a few dollars. That matters more to a small online shop than to Deere.

What the researchers found

The hacker used Cairn, an open-source platform that gives a group of AI agents a goal, splits it into steps and lets them share what they find on a common board. NorForge's principal researcher, Snorre Fagerland, started finding Cairn control panels left open on the public internet in early October. More than 20 of them looked malicious. The campaign itself had started on 25 September.

• The main group ran more than 1,100 attack projects across 14 linked panels. It targeted online shops in the US, Canada, Japan and Australia, with traffic of roughly 200,000 to 1.5 million.
• The goal was a web shell. The agents tried to run code on each site and plant a small uploader file, which gives the attacker a way back in later, likely for lasting access to the shop and its payment systems.
• A second group told its agents in plain English to steal credit cards and cryptocurrency.
• About 10% of attempts succeeded, by NorForge's estimate. A successful break-in took a little under 23 hours on average.
• The cost was small. Fagerland's rough estimate to Reuters was about $5,000 in AI usage overall, or about $50 per successful hack. The report puts the average at around $5 per task, failed ones included, and says the figures are uncertain.
• The model was cheap too. Every task ran on a worker labelled "claudecode_deepseek-v4.1-flash", which NorForge reads as Anthropic's Claude Code running DeepSeek's low-cost model.

Deere said it had taken remediation steps and saw no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product support site and was contained. Cummins said it was looking into a report about a website run by one of its vendors. Reuters could not establish how much data, if any, was taken. Cairn's author has said the tool was not built for hacking.

Read the victim list again

Two of the three named cases were not the company's main website. One was a standalone support site. One was a site run by a vendor. In another case in the report, the agents found nothing wrong with a large company's public application, so they went looking for something connected to it, found a control panel, and spent hours trying until its server ran their commands.

That is the pattern. Agents do not get bored. A person attacking a thousand shops gives up on the well-kept ones and moves on. An agent will try for 23 hours, then try the old microsite, the staging copy, the forgotten admin page and the plugin nobody updated. At $50 per success, a small shop is not too small to be worth it.

We see the scanning side of this on our own site. On 18 October our analytics recorded about 4,800 sessions in a single day from one country, almost all of them automated, against a normal day of 100 to 300. We cannot say who sent them. We can say that nobody needs to choose your website to find it.

Six checks for a small business website

None of these needs AI knowledge. Most are an hour or a short conversation with whoever runs your site:

1. List every site and panel you own, not just the main one. Support sites, old landing pages, staging copies, a booking system on a subdomain, the hosting control panel. Two of the three named victims were secondary sites. If something is no longer used, take it down.
2. Keep admin and control pages off the open internet. Your shop's admin, your hosting panel, phpMyAdmin, any dashboard a tool installed. Put them behind two-factor login, and where your host allows it, limit them to your own IP addresses. The attackers' own control panels were found because they were left public. So were the ones they broke into.
3. Apply updates to the shop platform, theme and plugins every week. WooCommerce, Magento, OpenCart, Shopify apps, whatever you run. Turn on update notices and make one person responsible for installing them.
4. Get an alert when files change. A web shell is a file. Most hosting panels and security plugins can email you when a new file appears in your site's folders, especially an uploads folder. If a .php file shows up where only images should be, that is the alert that matters.
5. Keep card numbers off your server. If your shop uses the payment provider's hosted checkout or payment form, card details are typed into the provider's page rather than yours. A web shell on your server then has much less to steal. Ask your developer which one you have.
6. Keep keys and passwords out of website files. The exposed panels in this case leaked hundreds of credentials and API keys, and about one in nine still worked. Anything in a public folder will be found by a scanner. Store secrets outside the web folder, give each tool its own key, and replace any key that has ever sat somewhere public.

What to watch in your logs

A 23-hour attack is noisy. It looks like a burst of failed logins, a run of requests for pages that do not exist, and repeated attempts on the same form or upload URL. Most hosting panels show this in their raw access logs or a security dashboard, and many can email a daily summary. You do not need to read every line. You need someone to notice when a normal day of a few hundred requests turns into thousands.

If you find a file you did not upload, do not just delete it. Take a backup of the site as it is, change the hosting, admin and database passwords, then remove the file and update everything. A web shell is usually there to let someone back in, so one removal is rarely the end of it.

The short version

AI did not invent a new way into websites. It made the old ways cheap enough to try on everyone, all day. The defence is the same one it has always been: fewer things exposed, everything updated, and a person who notices when something changes.

Sources

• TNW, AI agents broke into 100+ sites for one hacker at $50 each, researcher says, 19 October 2026. Summarises NorForge's report by Snorre Fagerland and Reuters' reporting: Cairn, the campaign start on 25 September, the three clusters, 1,100+ projects across 14 panels, target shops and traffic range, the web shell goal, 1,200+ sites attempted, the 10% success estimate, 23 hours per success, the $5,000 / $50 / $5 cost estimates, the "claudecode_deepseek-v4.1-flash" worker, leaked credentials (11% verified valid), the control-panel route, the Deere, SharkNinja and Cummins statements, the Cairn author's statement and Gambit Security's September findings. TNW notes it did not independently verify the intrusions.
• RuntimeAI, AI Security Incidents: Week of October 16, 2026, 16 October 2026. Context on other AI-assisted attacks reported the same week.
• DueClix analytics (Google Analytics 4), 18 October 2026: about 4,830 Direct sessions in one day, against roughly 100 to 300 on other days that week.