Oct 20, 2026

One Hacker's AI Agents Breach 100+ Sites as Microsoft and DHS Tighten Controls

One attacker's swarm of AI agents broke into 100+ company websites for about $50 per breach, as Microsoft unveiled agent risk controls and DHS ordered DeepSeek out of federal systems.

Listen to this update

A single attacker running a swarm of cheap AI agents managed to break into the websites of more than 100 companies in four countries, according to research published Monday by security firm NorForge and a parallel Reuters investigation. The disclosure landed on the same day Microsoft rolled out new tools to rein in misbehaving AI agents and the U.S. Department of Homeland Security ordered DeepSeek technology out of federal civilian systems. Together, the three stories show how quickly AI agents have moved from a productivity pitch to a front-line security problem.

A one-person campaign, run mostly by machines

NorForge researcher Snorre Fagerland began spotting suspicious deployments of Cairn, an open-source platform that coordinates multiple AI agents toward a goal, in early October. Roughly two dozen Cairn instances linked to malicious activity were left exposed on the internet, and some had open control panels. That gave researchers an unusual live view of the attackers' prompts and the agents' replies.

The most active operator, a Chinese-language actor, began the campaign on September 25 and aimed it at e-commerce sites in the U.S., Canada, Australia and Japan. Instructions to the agents were remarkably terse, often under 100 Chinese characters, with goals as blunt as fetching credit cards or crypto. More than 1,200 sites were targeted and roughly one in ten was breached. Successful intrusions took about 23 hours of automated work on average.

The economics are what alarmed researchers most. NorForge estimated the operation cost about $5,000 in AI usage, or roughly $50 per successful break-in. Per Gizmodo's account of the report, the attacker relied mainly on a mix of DeepSeek models and Anthropic's Claude Code.

The agents did more than scan. In one intrusion chain NorForge verified, they gained write access to an exposed session store, injected data into unsafe PHP deserialization, assembled an exploit from legacy Zend Framework components and planted a web shell for persistent access.

Reuters named John Deere, SharkNinja and Cummins among organizations connected to the campaign. Deere said it remediated the issue and had no sign that sensitive data was accessed. SharkNinja said the affected asset was a standalone product-support site and the threat was contained. Cummins said it was investigating a potential attack on a website run by a third-party vendor. No state sponsorship has been attributed, and Cairn's developer said on social media that the project was not built for hacking.

Microsoft treats agents as potential insider threats

Microsoft's answer to this kind of risk arrived the same day. New controls in Microsoft 365 E7 and its Project Perception security system give each AI agent a continuously updated risk score, based on signals such as what data it can reach and whether its behavior drifts from its assigned task.

When that score climbs, administrators can block the agent from making changes while still letting it read data, require a human to approve high-stakes steps, or shut the agent down entirely. Microsoft is also expanding detection of agents running on employee machines from 25 types to 60, a list that includes Claude Code, OpenAI's Codex and GitHub Copilot. New "Guardian Agents" will use AI to investigate why another agent's risk changed and to recommend or take containment steps.

The features are in private preview, with broader availability planned around Microsoft's Ignite conference on November 17–19 in San Francisco. Microsoft is competing with Google, AWS, CrowdStrike and Okta to become the default control layer for corporate AI agents, according to GeekWire.

Washington orders DeepSeek out of civilian agencies

On the policy front, DHS published a notice in the Federal Register ordering civilian federal agencies to remove products from DeepSeek and its parent, Hangzhou DeepSeek Artificial Intelligence, and to stop buying them. The order reaches beyond DeepSeek's own app to third-party services built on its models.

The action relies on the Federal Acquisition Supply Chain Security Act of 2018 and a review by the Federal Acquisition Security Council. CyberScoop reports the notice includes a June 26 letter from DHS Secretary Markwayne Mullin ordering the exclusion, meaning the ban has effectively been in force for months. Mullin cited data stored on servers in China and the risk that prompts and responses could pass sensitive information to the Chinese government. Agencies can seek exceptions only with a compelling justification, submitted 60 days in advance.

The order formalizes narrower moves made earlier by the Commerce Department, the U.S. Navy and states such as New York. DeepSeek is the only Chinese model named, though CyberScoop notes other Chinese open-weight models have drawn similar concerns.

Why it matters

The NorForge findings put a price tag on a fear security teams have voiced for two years: that autonomous agents could let one person do the work of a hacking crew. At around $50 per breach, the barrier to entry is now low enough that defenders can no longer assume attacks at scale require scale on the attacker's side. Vendors like Microsoft are betting that the fix is external oversight, watching what agents do rather than trusting the models behind them. Regulators, meanwhile, are focusing on which models can be trusted inside government at all. Expect all three threads to dominate enterprise security conversations heading into Ignite next month.