For two years the AI-offense debate has been mostly hypothetical. Now there are dashboards.
NorForge researcher Snorre Fagerland went looking for exposed web panels of AI hacking harnesses after Gambit Security’s September report on a campaign using Hermes, Strix and Cairn. Cairn turned out to be the neglected one. He found more than 20 open Cairn panels he assesses as likely malicious, with targets, findings, secrets and compromise status all on screen (per NorForge’s report, published Oct 19).
The numbers. The biggest cluster, which NorForge tags AIA0001, writes its tasks in Chinese and runs more than 1,100 attack projects across 14 panels. Reuters, which reviewed the activity itself, says the operator went after more than 1,200 sites starting Sept 25 and broke into websites belonging to more than 100 companies, Deere, SharkNinja and Cummins among them. Deere says it has no indication sensitive information was accessed. SharkNinja says a standalone product support site was hit. Cummins says it is looking into a site operated by a third-party vendor (per Reuters).
The price. NorForge estimates the average task at around $5 in tokens, counting the ones that die early, with a success rate hovering around 10%. Reuters puts the campaign at roughly $5,000 in tokens, about $50 per successful hack. NorForge flags considerable uncertainty. Fine. Even off by a few multiples, a foothold on a busy commerce site now costs less than a decent dinner.
The patience. Successful AIA0001 projects took a little under 23 hours from start to goal, logging about 140 facts each. One ran more than five days. No human grinds one storefront for a day for $50. An agent does. That changes which targets are worth hitting. The long tail nobody owns, the support portal, the regional store, the vendor-hosted microsite, just became economical.
The method is boring. That’s the point. Tasking is automated. Targets are ranked by traffic, 200,000 to 1.5 million, and pre-checked with Playwright to confirm an order can actually be placed. The goal is unauthenticated RCE through the classics: login SQLi, file upload, deserialization, SSTI, SSRF. One intrusion NorForge confirmed live had, by the agent’s own account, combined write access to a memcached session store with unsafe PHP deserialization and a gadget chain in legacy Zend Framework components. The worker name points at Claude Code driving DeepSeek 4.1 Flash, a cheap model. No frontier model, no zero-day factory. Old bugs, tireless effort.
What to hunt. AIA0001 didn’t want a command shell. Its tasks ask for an uploader shell, an HTML upload form plus move_uploaded_file, and explicitly not a command-executing webshell. That’s quieter, and plenty of webshell rules key on exec and system calls. So sweep web roots for new PHP files calling move_uploaded_file. Alert on one source working a single app for hours with SQLi, deserialization and upload probes. Watch for Playwright-driven headless Chromium placing test orders. And inventory every internet-facing site carrying your brand, including the ones a vendor runs for you.
The second-order risk. NorForge ran Trufflehog over the panel data and found hundreds of secrets, 11% verified valid. If an agent probed you, your keys may be sitting on an open panel anyone can read. NorForge also found legitimate red-team engagements exposed the same way. If you buy AI-assisted pentesting, ask where the harness runs, who can reach its UI, and where your findings and credentials live. Put it in the SOW.
Context. This isn’t the first agent-run spree. Reuters notes Gambit documented one in September that ended in breaches at 25 companies and the theft of at least 600,000 card records. What’s new is the view from inside the operator’s console.
The market read. Offense just got cheap, patient and parallel. Defense still mostly gets priced per seat and per alert. The vendors that win the next two years will make long, low-and-slow probing visible across the whole external footprint, including assets the customer forgot it owns. The good news, per NorForge: these operators can’t secure their own dashboards. That won’t last.