NorForge Uncovers Autonomous AI Agent Hacking Campaign: 100+ Orgs Breached for ~$5k in Tokens

Long-standing cybersecurity apprehensions regarding autonomous artificial intelligence agents executing end-to-end cyber intrusions without human intervention have transitioned into empirical reality. According to an extensive investigation by cybersecurity research firm NorForge and corroborated in an exclusive investigation by Reuters, a lone threat actor leveraged a coordinated fleet of AI agents to scan more than 1,200 corporate targets, successfully breaching over 100 organizations.

The campaign was unmasked when NorForge principal security researcher Snorre Fagerland identified more than 20 exposed, unauthenticated control panels of 'Cairn'—an open-source AI agent orchestration framework originally designed for multi-step automated problem-solving but repurposed for offensive intrusion. Because the command dashboards lacked password authentication, researchers observed the agents' operational task queues, target registries, and lateral movements in real time.

Intrusion Economics: Minimal Prompts, Relentless Iteration, and a $5k Budget

The primary threat actor observed by researchers issued high-level Chinese-language operational directives under 100 characters in length. Operating from these concise prompts, the autonomous agents decomposed tasks, conducted subdomain reconnaissance, probed perimeter services, analyzed error stack traces, and iteratively refined exploit payloads without manual guidance.

The economic metrics of the operation have sent shockwaves through defensive security circles: the aggregate LLM API token expenditure across 1,200+ targets totaled approximately US$5,000, averaging roughly US$50 per successful network breach. A single compromise loop averaged approximately 23 hours of relentless, uninterrupted computational exploration.

Attack Methodology: Subdomain Scrape and Deserialization Exploits

NorForge telemetry highlights the agents' persistent tactical pivoting. When primary enterprise web applications defended by commercial Web Application Firewalls (WAFs) proved resilient, the agents systematically mapped adjacent staging infrastructure and peripheral subdomains.

In one documented intrusion, an agent uncovered a legacy administrative panel, identified subtle data-deserialization parsing flaws, and after hours of automated trial payloads, achieved arbitrary remote code execution. Targets identified through observed logs included support portals and third-party vendors associated with heavy machinery manufacturer John Deere, appliance maker SharkNinja, and engine supplier Cummins.

Model Infrastructure & The Shifting Cyber Defense Paradigm

NorForge's telemetry indicates that the Cairn agent pipelines orchestrated models inferred to combine DeepSeek reasoning tiers alongside Anthropic's Claude Code via intermediary API routing proxies. The campaign demonstrates that cyber offensive parity no longer demands deep specialist teams; a single motivated operator with modest cloud capital can launch relentless, 24/7 automated campaigns.

“The primary threat of agentic cyber weapons is not that they invent novel zero-day exploits, but that they exhibit inhuman patience—testing thousands of subtle variations over 24 continuous hours for the price of a modest dinner.”

This public disclosure serves as an urgent wake-up call for enterprise security teams: securing the external attack surface and strictly authenticating agent control planes are no longer optional best practices, but mandatory operational imperatives in the era of autonomous intrusion.