One Operator, 1,200 Websites, $50 a Breach. What the Cairn Agents Went Looking For.

01 What NorForge saw through the open panels

NorForge sorted the panels into three clusters and gave them the prefix AIA, for AI Activity.

AIA0001 is the one Reuters reported on. Its target list came pre-sorted by traffic: sites with between 200,000 and 1.5 million visits, in four countries, each one checked with a headless browser before the agents were sent in. Busy, mid-sized shops made up most of the list. Two of the three brand names Reuters identified were hit at the edge of their estates: a standalone support site and a website run by a vendor.

Fagerland has worked in security for nearly three decades. His summary to Reuters was short: “It’s not script kiddie stuff.”

02 The brief was under 100 characters

The operator’s instructions to the agents ran to fewer than 100 Chinese characters. Find a way to run code on the site. Then plant an uploader web shell [ Reuters 2026 ] .

An uploader shell is a small file that lets the attacker push more files onto the server later. It does nothing loud on day one. It gives the operator a way back in once they decide how to make money from the access. NorForge confirmed one live shell on the site of a large hardware parts vendor [ TNW 2026 ] .

The work ran on a worker NorForge saw labelled claudecode_deepseek-v4.1-flash, which reads as Anthropic’s Claude Code harness driving DeepSeek’s V4.1 Flash model. Reuters reported it as a mix of DeepSeek and Claude Code. Alongside the models, the agents had ordinary tools: Nmap, ffuf, Amass, dnsrecon, Playwright and PHPGGC, plus a public proof of concept for a Magento flaw [ NorForge 2026 ] . Nothing on that list is exotic. Every tool is free, and a penetration tester would recognise all of them.

03 The hit list, and where it lives on your estate

NorForge published the priority order AIA0001 gave its agents. Read it as the first page of your own test plan. Each line below is a class of flaw the agents went for, where it usually sits on a company web estate, and the question to put to whoever runs that system.

The third cluster, AIA0003, listed a wider set: server-side template injection, server-side request forgery, remote code execution and business logic flaws on top of the above [ NorForge 2026 ] . That list is close to the standard web application checklist. The agents work through known attack classes on every site, patiently, at a price that makes a 10% hit rate profitable.

04 When the front door held, the agents went round the side

One case in the Reuters reporting matters more than the totals. The agents found no weakness in a large company’s public-facing application. So they went looking at the infrastructure around it, found a public control panel, and after hours of trial and error exploited a subtle data-processing flaw that made the server run their commands [ Reuters 2026 ] .

NorForge describes another verified intrusion in technical detail. The chain ran through write access to a memcached session store that should not have been reachable, then unsafe PHP deserialisation, then a gadget chain in legacy Zend Framework components. In a separate case an agent found the one cookie setting that routed it to the vulnerable back-end server [ NorForge 2026 ] .

Each of those steps is unremarkable alone. A session cache left open on the network. An old framework still in the build. A load balancer that sends some requests to an older server. Human testers find chains like this, but they need time, and a fixed-scope engagement often runs out of days before it reaches the admin panel on a neighbouring host. The agent does not run out of days. One NorForge project ran for more than five.

05 23 hours and $50: what the numbers change

A successful AIA0001 project took a little under 23 hours from start to goal, and logged about 140 findings on the way [ NorForge 2026 ] . NorForge puts the average cost at around $5 per task including the failures, with the biggest projects possibly passing $100. Fagerland’s $50-per-breach figure is the same arithmetic seen from the other end.

Three things follow for anyone defending a website.

• Being mid-sized no longer hides you. At $5 a try, an operator can afford to attempt every shop in a traffic band, and AIA0001 did exactly that.
• Your detection has to notice a slow, tireless visitor. Twenty-three hours of methodical probing from one source does not look like a burst attack. Rules tuned for spikes will miss it.
• Annual testing leaves eleven months open. The agents re-run cheaply. A site that changed in March and gets tested in November spent eight months exposed to anyone with a token budget.

06 Test it before an agent does

Deere said it took remediation steps and saw no sign that sensitive information was accessed. SharkNinja said it contained the attack. Both statements came after the agents had already been inside [ Reuters 2026 ] . You want that list from your own test instead. These six checks follow directly from what NorForge published, and a web team can start all of them this month.

An agent spends $50 and a day on your website. You can spend 14 days finding the same routes first. Your Threat Map maps every web property under your name, works through the list the Cairn agents used, and gives you each route in, proven, with the fix ranked by what it would have reached. From $5,000. Enterprise-grade. Not enterprise-priced.