AI Agents Breach More Than 100 Companies at a Cost of Just $50 Per Hack
Researchers uncovered a large-scale cyberattack campaign in October 2026 in which autonomous AI agents breached more than 100 companies, including major industrial firms, at an estimated cost of roughly $50 per successful intrusion. A single hacker spent approximately $5,000 on AI tokens to target more than 1,200 websites across four countries. Security experts say the campaign marks a fundamental shift in the economics of cybercrime.
Autonomous AI agents breached more than 100 companies in a single campaign uncovered in October 2026, with each successful intrusion costing the attacker roughly $50 in AI processing fees.
The campaign, reported by Shattered.io and security researchers at NorForge, was orchestrated by a single hacker who spent approximately $5,000 on AI tokens to target more than 1,200 websites across the United States, Canada, Australia, and Japan. Victims included major industrial firms such as Deere, SharkNinja, and Cummins.
The attacker used a combination of AI models, including DeepSeek and Anthropic's Claude Code, integrated through an open-source agent orchestration framework called Cairn. Unlike traditional automated attacks that rely on pre-scripted exploits, these agents operated with high autonomy. They could probe infrastructure, interpret technical feedback, adapt to failed attempts, and pivot to related systems.
The hacker's operational instructions were reportedly written in fewer than 100 Chinese characters, demonstrating that minimal human oversight was needed once the agents were deployed. Successful intrusions required an average of 23 hours of continuous autonomous probing.
The $50-per-breach figure reflects the low cost of AI processing power for tasks that previously required skilled human operators. Security researcher Snorre Fagerland of NorForge said the campaign shows that the profitability threshold for cybercrime has dropped sharply.
The campaign was discovered because the attackers failed to secure their own management panels, which were left exposed on the open internet.
Security experts say the incident highlights the vulnerability of legacy infrastructure and the need for continuous, automated monitoring rather than periodic vulnerability scans. Organizations are urged to prioritize speed in their security response as AI-driven attacks become faster and cheaper.
