$50 Per Breach: What the Cairn Campaign Changes for Defenders

Autonomous agents just repriced enterprise intrusion. NorForge's October 19 investigation into exposed Cairn control panels documented a single operator breaching 100+ companies , John Deere, SharkNinja, Cummins among them , at an estimated cost of roughly $50 per successful break-in. The operator typed fewer than 100 Chinese characters of instructions. The agents did the rest, running unsupervised for up to 23 hours per target. Periodic code review is no longer a defensible posture against that threat model.

What NorForge Actually Found#

Snorre Fagerland, principal threat researcher at NorForge, began locating exposed Cairn panels around October 2 using Shodan and Censys. Cairn is an open-source, state-based problem-solving engine: operators define a start point and a goal, agents work toward it autonomously, posting discoveries to a shared blackboard along the way.

More than 20 panels were assessed as likely malicious. Three clusters emerged. The most active, AIA0001, operated in Chinese, spanned 14 dashboards, and ran over 1,100 attack projects. Targets were e-commerce and payment sites in the US, Canada, Japan, and Australia , pre-qualified by traffic volume (200,000 to 1.5 million visits) and confirmed orderable via Playwright before being handed to the agents.

The worker identifier on AIA0001 tasks read claudecode_deepseek-v4.1-flash , consistent with a Claude Code harness running the DeepSeek V4.1 Flash model released in September 2026. NorForge estimates the average task cost at around $5, including failures, placing the total campaign spend near $5,000.

Fagerland's assessment, reported in coverage of the NorForge findings, was blunt: this is not script kiddie activity.

The Attack Surface These Agents Targeted#

The AIA0001 task template is explicit and worth reading carefully. Agents were instructed to find unauthenticated RCE via command injection, deserialization, file-upload webshell, SQL injection leading to RCE, SSTI, or SSRF. Priority targets: login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass, account takeover.

One confirmed intrusion chain used unauthorized write access to a memcached session store, combined with unsafe PHP object deserialization and an exploitable gadget chain in legacy Zend Framework components. A separate case involved agents locating a linked control panel after finding no flaw in the primary application, then spending hours on trial and error until they achieved remote command execution. NorForge verified the web shell live on a large hardware parts vendor's server.

None of these entry vectors are novel. Deserialization gadget chains, exposed admin panels, and unvalidated file upload paths have appeared in vulnerability disclosures for years. What changed is that an agent can now chain them in sequence, across 1,200 targets, while the operator sleeps.

The Secrets Problem Nobody Is Talking About Loudly Enough#

The NorForge report contains a finding that deserves more attention than the $50 headline. Scanning the exposed Cairn panel data with Trufflehog surfaced hundreds of secrets , API keys, credentials, other material harvested during reconnaissance , and 11% were verified valid.

Think through what that means structurally. The agents accumulate secrets from target environments as facts on the shared blackboard. Those facts persist in the panel. The panel is exposed on the public internet. The result is not just a compromised application , it is a living, searchable dump of valid credentials available to anyone who finds the panel before NorForge does.

Some of those panels belong to legitimate red teams who left client work exposed. Fagerland's report flags this directly. The opsec failure is bipartisan.

The Defender's Checklist#

The attack surface AIA0001 prioritized maps cleanly onto detectable code patterns. Not configuration errors that require runtime observation, but static properties of source code that exist before any request is made.

Unauthenticated endpoints are a code property. A route decorator is either present or absent. File upload handlers that call move_uploaded_file without extension validation are readable in source. Deserialization of untrusted input from session stores is a pattern a scanner can flag. SQL queries constructed by string concatenation are visible before the query runs.

The same is true of hardcoded secrets. Credentials committed to a repository are not a runtime event , they are a static artifact that persists in git history long after the engineer who wrote them has moved on. NorForge ran Trufflehog over panel data and found hundreds. Running the same class of scan over every PR and every push is not ambitious; it is the minimum.

The 13-step verification Hyrax runs before submitting any pull request includes checks across exactly this territory: hardcoded credentials, over-permissive IAM, exposed webhook endpoints, unsafe deserialization, and unvalidated file handling. These are the six agent domains , security, code quality, reliability, API and data, ops, and UX , applied to every commit, not just the ones flagged in quarterly audits. Hyrax submits the fix as a PR; the engineer merges.

The broader point, covered in the five AI-code failures your CI does not catch, is that standard CI catches build failures, not semantic vulnerabilities. The gap between "compiles and passes tests" and "safe to expose to an autonomous scanning agent" is large, and it is not closing by itself.

What the $50 Number Actually Tells You#

The cost figure is an estimate with, as NorForge acknowledges, considerable uncertainty. Individual projects ranged from early-terminating cheap runs to multi-day campaigns exceeding $100. The $50 average is a midpoint across a distribution that will compress further as models get cheaper and harnesses improve.

The more precise observation is this: at a 10% success rate across 1,200 attempts, 100 breaches is the expected outcome. Not a remarkable achievement. Not an advanced persistent threat. The expected arithmetic result of running a well-configured agent at scale against a target population with known vulnerability classes present.

That is the shift. Intrusion used to require either exceptional skill or exceptional patience. Cairn-class tooling replaces patience with compute and replaces some skill with iteration. The operator who ran AIA0001 had no need to understand memcached session serialization. The agent figured it out in under 23 hours and posted the chain to the blackboard.

What Defenders Should Do Before Next Quarter#

Three things are immediately actionable given what NorForge documented.

First, scan for secrets in the current codebase and in git history, not just in new commits. Valid credentials found in Cairn's panel data did not appear from nowhere , they were harvested from running systems, which means they exist somewhere upstream in source or configuration.

Second, audit file upload handlers. The AIA0001 task template specifically targeted move_uploaded_file implementations. If any upload endpoint accepts arbitrary file types or writes to a web-accessible directory, that is a prioritized target for this class of agent.

Third, treat admin and control panels as part of the attack surface. Several AIA0001 successes came not from the primary application but from linked internal panels that were discoverable from the public application. Network segmentation and authentication on internal tooling are not optional hardening steps.

The broader posture shift is harder to prescribe but more important. Agents that probe 1,200 targets in a few weeks will find whatever is findable. Periodic human review of security-relevant code, on a sprint cadence or slower, leaves a window that is now measured in days.

Hyrax is live at hyrax.dev.