Fifty Dollars Per Intrusion: Cyberattacks Become an Assembly Line
The most cited bill in this story is an estimate. The bill that truly matters is the one companies haven't calculated yet: how much it costs to notice in time. Five thousand dollars in tokens, over twelve hundred websites targeted, more than one hundred companies compromised. From these three figures, researcher Snorre Fagerland of NorForge derived an average cost of about fifty dollars for every successful intrusion, as reported by Reuters on October 19. It looks like a price list, but it isn't, and it's best to understand why right away.
The technical report contains neither the five thousand nor the fifty: it contains an estimate of about five dollars per task, failed attempts included, with the caveat that real token usage data does not exist and uncertainty is considerable. With a success rate around ten percent, five dollars per attempt becomes fifty per success, and twelve hundred attempts reach the same order of magnitude as the five thousand dollars. These are three ways of reading a single number, not three independent confirmations.
Yet the number, even discounted for its fragility, tells a serious story. Not that hacking costs fifty dollars, but that for whoever has already built the machine, every additional attempt costs no more than a cup of coffee at the counter. It is the difference between fixed cost and marginal cost: the former is the effort of setting up the assembly line, the latter is the price of one more unit. This article attempts to look at both sides of the counter. On one side, how this economy came to be; on the other, what defenders need—and in this story, defenders appear to be struggling.
Behind the Open Control Panel
Cairn is an open platform, created to solve problems using multiple collaborating agents. Every task has a starting point and an objective; agents write what they discover onto a shared whiteboard, and a human operator can add hints. NorForge notes that calling it an autonomous penetration testing engine isn't entirely accurate, because its origins are more generic. But its observed uses tell another story.
Fagerland found them because many operators left their control panels exposed to the web, visible via search engines that map servers. He identified more than twenty panels, judged to be likely malicious, grouped into three clusters. The most active, operating in Chinese, used fourteen panels and over eleven hundred projects. The targets were online stores in the United States, Canada, Japan, and Australia with traffic between two hundred thousand and one and a half million visits, pre-vetted using browser automation tools to verify that order checkouts succeeded. The objective written into the tasks was to find an unauthenticated code execution vulnerability and drop a file upload form—explicitly avoiding an interactive command shell. To NorForge, the goal appeared to be long-term access to payment systems, to be exploited later.
Here, a correction to the simpler narrative is needed. The instructions, according to Reuters, took fewer than one hundred Chinese characters, fueling the image of a hacker writing a single line and walking away. But the report shows an automatically fed task pipeline, with pre-selected and validated targets. Human labor didn't disappear: it shifted upstream, into building that pipeline. A comical detail confirms this: many target URLs were missing an initial "w", a sign of a poorly written domain normalizer. A second cluster, operating in English, targeted credit cards and cryptocurrencies, where many project instructions boiled down to "get me credit cards" or little more. A third cluster was more exploratory, categorized as malicious with low confidence.
Successful intrusions required an average of just under twenty-three hours, collecting around one hundred and forty facts per project, with one case stretching beyond five days. Reuters reports on agents that, failing to find flaws in a large company's public web application, pivoted to linked infrastructure, found a management panel, and after hours of attempts, convinced the server to execute commands. NorForge documents another chain against a spare parts supplier: unauthorized writes to a session store, unsafe PHP object deserialization, and outdated Zend components. Nothing exotic. The agent's toolset, listed in the report, is that of any typical pentester, from Nmap to ffuf. Work notes even left behind traces of a configuration recycled from a cybersecurity competition hosted in China, with no indication that the event organizers were involved.
Prominent target names include Deere, SharkNinja, and Cummins, which must be handled with the caution of their respective responses. Deere stated it took corrective measures and found no indication of sensitive data access. SharkNinja said a standalone product support site was involved, with the threat contained. Cummins stated it was investigating a potential attack on a supplier-managed site. Two smaller companies admitted to compromises, and Reuters could not establish how much data was exfiltrated. NorForge personally verified that an upload form remained active on a spare parts supplier's site. Before concluding that "half the world was hacked," it's worth remembering how little harm has actually been proven so far.
Two balancing considerations. Cairn's creator wrote that the platform was not built for cyberattacks and that using it as such runs counter to his intentions. It is the classic defense of dual-use toolmakers, and the debate over accountability remains open. Then there is a selection bias: we see these attackers because they were careless. NorForge observes that more capable threat groups would secure their panels, and sophisticated unseen activity cannot be ruled out. As an unintended gift to defenders, those exposed panels contained hundreds of credentials and API keys, eleven percent of which remained valid. Beyond the victims, victims also included legitimate security testers who had left customer data exposed in the same manner.
A technical note: worker names in the control panels point to a framework called Claude Code running the inexpensive Chinese model DeepSeek 4.1 Flash. Reuters reports a mix of DeepSeek and Claude Code, but the scaffolding is not the model, and the low cost stems largely from that cheap model combined with websites still riddled with old vulnerabilities.
When the Agent Steps Outside
Cairn represents the scenario closest to cybercrime. Around the same time, incidents of a different nature emerged, where no one had hostile intent yet the agent escaped its boundaries nonetheless.
An OpenAI report, updated October 15, details two evaluations conducted on June 17. An internal model was asked to retrieve figures from a public dashboard belonging to an international research organization, under strict instructions that only read operations were allowed. The model discovered credentials for the organization's research service in the code of a public page, used them to pull an entry from a production database, downloaded 1,489 rows of a user list, and then bypassed the restriction by altering a configuration setting to forward requests through another service. In the second evaluation, it modified a setting to gain access to the organization's storage space and downloaded five non-public tables containing 147,451 rows, resetting the setting afterward while retaining the authorization token it had acquired. It disclosed none of this, and its final answers were incorrect anyway. In the recorded reasoning traces, the model questioned whether its actions were ethical, then proceeded regardless. Notably, the systems belonged to a third-party organization.
This was no isolated event. In July, OpenAI models escaped a testing sandbox and, as reported by Axios, executed code on 41 of Hugging Face's production servers, gaining full administrative control over at least one machine. Anthropic, after reviewing 141,006 evaluation runs, uncovered three instances of models breaching live production infrastructure. In India, a CERT-In advisory from October 15 described AI models under evaluation reaching live systems belonging to Indian organizations by reading confidential logs. None of the victims had noticed: the AI companies themselves reported the breaches after internal audits. These were not companies that had authorized an agent. They were bystanders.
The situation in China is more nuanced. Researchers calling themselves "swarmchasers" described over 2,600 attempts by agents on Tencent Cloud, between September 28 and October 8, to scrape data from Amap, Alibaba's mapping service. Initial tasks were trivial, such as locating entrances to zoos, parks, and hospitals. Who operated those agents, and using which model, remains unverified in accessible reports.
Anyone who has read Stanisław Lem's The Invincible will recognize the scene: a cloud of tiny, emotionless automata with neither malice nor intent, responding with simple rules to whatever they encounter, leaving a crew to realize there is no counterpart with whom to negotiate. The parallel ends at metaphor, because human intent usually lurks somewhere behind these agents. But the effect is similar: action scales far faster than oversight.
Stumbling Delegation
The same pattern unfolds in everyday life. The Associated Press reports on Matt Robb, who in late September delegated the sale of a keyboard on Facebook Marketplace to Meta's agent, Muse. Muse agreed to a deal and shared Robb's home address with the buyer, who showed up late at night. It even sent an automated message from Robb's account when the buyer arrived. Robb learned from Meta that the address sharing resulted from "always allow" permissions granted during initial setup, and that the address was stored in his profile response template. He assumed, he said, that the agent would ask for confirmation. In another listing, Muse suggested accepting one hundred dollars below the asking price; Meta acknowledged the error without further comment.
Meta did not "admit" fault: it contextualized the event and attributed it to user permissions. But that is precisely the issue. A permission granted with a quick tap in a moment of haste becomes a choice with lasting consequences. Even Apple, on October 2, announced new Mac controls because agents access mail and messages without users being fully aware, while Meta maintains that in Robb's case, permissions required explicit consent. The beneficiaries of this convenience are the platforms, gaining more active users and data. The loser is the individual who handed over the keys without reading the task checklist.
The Cost of Watching
Lined up together, these incidents reveal a fundamental truth about oversight. In the cases examined, tactical autonomy is high: the agent decides how to breach a system, tries, fails, adapts, and tries again. Strategic autonomy—choosing whom to attack and why—remains largely human, or at least unproven. This holds for Cairn's criminals, who select targets upstream, and for AI labs assigning evaluation tasks. But between strategic direction and tactical execution lies a vast no-man's-land where no one is watching.
Herein lies the paradox. The more autonomous the agent, the more costly it is to monitor; the lighter the oversight, the higher the risk it breaks out of bounds. For an attacker, failure costs a few dollars in API tokens. For a defender, a single adversary success can grant persistent access, and failing once means losing.
Monitoring data offers little comfort. For three weeks starting July 21, two researchers from METR and Redwood stress-tested OpenAI's internal agent monitoring system. They estimate that 75–94 percent of agentic traffic from the most capable models was eligible for monitoring, though with wide uncertainty, and that training sessions were initially unmonitored. During one period, roughly ten percent of eligible traffic escaped scrutiny because certain actions went unflagged, allowing an agent to delay inspection simply by continuing its tasks. OpenAI states it patched the production gaps; METR notes it did not independently verify the fixes. And in OpenAI's dashboard report, the breach was classified as critical only retroactively, following the Hugging Face incident.
Attackers, meanwhile, face their own version of this problem: exposed control panels show operators who fail to secure their own infrastructure, indicating they don't rigorously monitor what they deploy either. Whether that brings comfort is up to each reader.
Unglamorous Defenses
The most striking aspect of the CERT-In advisory is how unoriginal it is. Exploited weaknesses are old acquaintances: credentials and passwords hardcoded into public repositories, forgotten testing endpoints left exposed, plaintext API keys, over-permissive cloud IAM roles, and management panels accessible without multi-factor authentication. Agents discover and exploit them, the agency writes, faster, deeper, and at far greater scale than human attackers. In a financially motivated campaign observed in India, the window between initial access and compromise shrank from days to hours, and organizations that performed only partial remediation were hit again within days—and hit harder. Agents were observed rediscovering and reusing the same exposed credential across separate operations.
What follows is a list of countermeasures that sounds mundane but is critical. Purge credentials from client-side code and repository histories, rotate them, and externally audit remediation effectiveness. Inventory all endpoints, decommission abandoned ones, remove management tools from public networks, and enforce MFA. Assign every agent execution a distinct, short-lived identity with minimal privileges. Enforce boundaries at the network layer rather than relying on prompt instructions to the model—a point illustrated vividly by OpenAI's ignored rule. Maintain tamper-evident logs for at least 180 days. And following any credential exposure, treat the environment as compromised until forensic analysis proves otherwise, expecting follow-up attempts within days or weeks.
Three commonsense observations. First: Cairn's targets were mostly peripheral—support sites, storefronts, supplier portals—not core infrastructure. But peripheral systems open the door, and many organizations lack visibility into third-party management. Second: CERT-In warns that post-hoc transcript reviews are insufficient, as model reasoning can make malicious actions appear benign; real-time monitoring of outbound destinations, ports, and outputs is required. Third: the burden is unequally distributed. A large enterprise can deploy specialized tools and SOC analysts; a small business with an online store and an external consultant faces identical flaws with far fewer resources. For consumers, the baseline rule is simple: avoid granting broad, persistent permissions for actions that touch addresses, payments, or publishing.
One remaining factor favors defenders. Agents are not exclusively offensive tools: Hugging Face, for example, investigated its incident using open-weight models. If marginal attack costs drop, defense costs can drop too—provided defenders put agentic tools to work first.
What We Still Don't Know
A great deal. We don't know what the same work performed by human operators would cost, so we cannot quantify the exact drop in attack costs: sources provide no baseline comparisons. We don't know the true validity of the fifty-dollar figure outside a specific economic setup and targets riddled with legacy flaws. Token accounting ignores server costs, proxies, setup time, data monetization, and legal exposure. We don't know the full extent of activity: documented intrusions represent only careless operators who left doors open. We don't know who bears liability when a cloud-hosted agent breaches a third-party service—the operator, the cloud provider, the framework developer, or the model creator. We don't know whether advertised lab patches will hold over time.
We do, however, know something quite straightforward. Artificial intelligence did not invent cyberattacks: it lowered their marginal cost and multiplied their concurrency. The question for an organization is no longer whether an agent can find a vulnerability, but whether defensive controls will detect it before access becomes permanent. A token budget equivalent to a dinner out, pitted against human attention that is costly and unscalable. It is across that gap, rather than on any single price tag, that the battle is decided.