One hacker's AI agents tried 1,200 online stores and got into more than 100. Where victims have said what was hit, it was the side site nobody was watching.

The direct answer first. A security researcher at NorForge spent the last few weeks watching an attacker run AI agents against online stores, and Reuters published what he found on 19 October. One Chinese-speaking operator gave a set of open-source agents a short brief, fewer than 100 Chinese characters, and let them work. By the end of last week they had tried more than 1,200 sites and broken into the websites of more than 100 companies, including Deere, SharkNinja and Cummins. The researcher puts the bill at about $5,000 in AI usage, or roughly $50 per break-in. Two details matter more than the headline. The agents were told to go after shops that work: real stores with real traffic, checked in advance to make sure an order could be placed. And where victims have said what was hit, it was not the main store. It was a standalone product support site, and a website run by a vendor. For a growing merchant, the lesson is not to harden the checkout again. It is to find every other website that carries your name.

What actually happened?

NorForge's principal threat researcher, Snorre Fagerland, found more than 20 control panels for an open-source agent platform called Cairn sitting open on the internet, and could see what the people using them were doing. His report, published the same day as the Reuters story, describes three separate clusters of activity. The largest is the one Reuters covered:

• The campaign started on 25 September. Fagerland began seeing it around 2 October.
• One operator, writing in Chinese, ran more than 1,100 projects across 14 control panels.
• The agents attempted more than 1,200 sites and, per Reuters, got into the sites of more than 100 companies in the US, Canada, Australia and Japan.
• A successful break-in typically took a little under 23 hours of automated probing. Nobody had to sit and watch.
• Fagerland told Reuters the operator spent about $5,000 in AI tokens, roughly $50 per success. His written report estimates about $5 per attempt once the many failed attempts are counted, with a success rate of around one in ten.
• The goal was a foothold: a small upload page planted on the server, deliberately not a full remote-control tool. NorForge notes the attacker can turn that into something worse at any time.

Why were these stores on the list?

Because they were working businesses. NorForge published the task the operator handed the agents, and it reads like a sales prospecting brief:

• Confirmed real shopping and e-commerce websites in four countries, including Canada.
• Monthly traffic between 200,000 and 1.5 million visits.
• Each site pre-checked with a browser automation tool to confirm that orders can actually be placed.
• A shortlist of weaknesses to look for first: injectable login forms, endpoints that answer without a sign-in, file uploads, unsafe handling of incoming data, ways round authentication, and account takeover.

Read that as a merchant. This is not a list of global brands, and it is not a list of abandoned hobby sites. It is the middle of the market: stores large enough to be worth the effort and small enough that nobody is reading the server logs at three in the morning. Being a real, functioning shop is the qualifying condition.

Why the side site and not the storefront?

Look at what the victims chose to say. SharkNinja: a standalone product support site. Cummins: a website operated by a third-party vendor. NorForge confirmed a live upload page on the site of a hardware parts vendor. And the one break-in the agent explained step by step ran through an exposed cache server and legacy framework code, which is to say old software that nobody had come back to.

Our reading: a storefront on a hosted platform such as Shopify is a poor target for this particular kind of attack, because the platform runs and patches the servers underneath it. What a merchant owns is everything built around the store, and that list is usually longer than anyone remembers:

• A support, warranty or product-registration site, often built once for a launch and never touched again.
• A blog or content site on a separate system, with its own plugins and its own admin login.
• A wholesale or B2B ordering portal.
• A custom app, middleware or integration server that sits between the store and the ERP, the warehouse or the CRM.
• Old campaign microsites and staging copies that are still answering on the internet.
• Sites a vendor runs under your name: a rebate portal, a dealer locator, a returns page.
• On WooCommerce, Magento or a custom build, the store server itself, its plugins and its extensions.

What changed is patience. Twenty-three hours of probing is not worth a human attacker's time for a support site with a few hundred visits a day. For an agent that costs a few dollars to run, it is a normal working day, and it does not get bored on page forty of the same subdomain.

What does a foothold turn into at a store?

September already answered that. Gambit Security published an interim report on 22 September about a different operator using a similar set of open-source agent tools, Cairn among them. Between 10 and 15 September it counted at least 27 companies compromised, and it recovered at least 600,000 unexpired card records taken from two of them. The method was card skimming: code slipped into checkout pages that copies card details as shoppers type them. Gambit says the operator steered its agents toward custom-coded stores, and lists the places the skimmer was hidden, including the end of a legitimate JavaScript library, the site's Google tag block, and a scheduled task that quietly put it back whenever someone removed it. The operator's own records put the average cost at about $25 per store scanned. In one case the agents' clean-up step was so broad that a bicycle retailer lost 180 database tables, backups included.

Put the two reports side by side. October's upload page is the foothold. September shows what a foothold becomes once it is on a store's server.

The two conclusions that both get this wrong

What should you do this week?

• List every website that carries your name. Subdomains, support portals, blogs, wholesale portals, landing pages from past campaigns, staging copies and anything a vendor hosts for you. A certificate transparency search on your domain, for example on crt.sh, is a free way to find subdomains you forgot existed.
• Give each one an owner and a last-updated date. If nobody can say who patches it, take it offline or put it behind a login.
• Ask your vendors three questions in writing: which sites do you run under our name, when were they last patched, and would you tell us within 24 hours of a break-in?
• Take admin panels and control consoles off the open internet. Put them behind single sign-on or an allow-list, with multi-factor sign-in on every account.
• Watch what runs on your checkout. Keep an inventory of the scripts on payment pages, review who can publish to your tag manager, and set an alert for any change. If you take card payments on pages you control, PCI DSS 4.0 already expects exactly this.
• Alert on patient probing: one source working through odd URLs for hours on a site that normally sees a handful of visitors.
• Back up the store database somewhere the web server cannot reach or delete, and test a restore. An agent's clean-up step can do as much damage as the theft.
• If you buy an AI-driven penetration test, ask where it runs and who can see the results. NorForge's own warning is blunt: having your site tested on an open Cairn instance is often a serious security issue, regardless of the outcome of the test.

Where we fit

Most growing businesses cannot answer the first question on that list, because the support site was built by one agency, the wholesale portal by another, and the rebate page by a vendor nobody has spoken to since launch. This is the security work we do: our own AI agents run the inventory and the forensics in parallel, across DNS records, server logs, edge analytics and configuration, while a senior engineer directs the investigation and makes every remediation call. We have done this under pressure before, containing a scraping botnet that peaked at 10,630 unique IPs an hour on the evening it was detected. For a merchant reading this report, retaining us means one pass over the store and every site around it: a complete list of what carries your name, an owner and a patch status for each, the dead sites retired, admin consoles locked down, the checkout's scripts monitored, and alerts set for the slow, patient probing these agents rely on. When the next report like this lands, you already have the list, and someone is watching it.

Sources

• Reuters via BNN Bloomberg: How one hacker used AI agents and a few thousand dollars to break into scores of sites (19 October 2026; victims, statements, the $5,000 and $50 estimates)
• NorForge: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (19 October 2026; the primary report, task text, target criteria, success rate and cost per task)
• The Next Web: AI agents broke into 100+ sites for one hacker at $50 each, researcher says (19 October 2026; summary of both reports and how the two cost figures differ)
• Gambit Security: AI Agents Are Hacking Online Retailers for $25 a Company (22 September 2026; the separate card-skimming campaign, interim findings)
• JTS Tech: India's cyber agency says AI agents under test walked into live company systems (18 October 2026; the keys-left-in-public route)
• JTS Tech: An AI agent read its own host's kernel version, downloaded a public exploit, and became root (30 August 2026; why a known, unpatched flaw is now a same-week problem)
• JTS Tech: You can do the structured data perfectly and still be invisible (3 August 2026; the cost of blanket bot blocking)
• JTS Tech case study: A 10,000-Bot Swarm, Contained in an Evening