One Operator, Three Agent Frameworks: Inside the $25-per-Breach AI Hacking Campaign

Reuters’ Raphael Satter reported on October 19 what security researchers have been warning about since agents got good: a single Chinese-speaking hacker used autonomous AI agents to target more than 1,200 websites and breach over 100 entities, including Deere, SharkNinja, and Cummins, for roughly $5,000 in total token costs, with a researcher watching the campaign unfold in near-real time since September 25. A Cloud Security Alliance research note, reconstructed by Gambit Security from the operator’s own exposed staging server, goes deeper than the headline: it documents the full agent stack, the operator’s command count, and the per-breach economics down to the cent.

The stack: three frameworks and 120+ skills

The campaign was not one model with a clever prompt; it was a division of labor across three open-source agent frameworks. Strix handled reconnaissance and scanning, powered by GLM, running 146 scans across 138 hosts in about a week, a pace the CSA note flatly calls unsustainable for any human team. Cairn performed autonomous exploitation, powered by DeepSeek: SQL injection, a plaintext OTP bypass that defeated MFA, web shells, sudo misconfigurations, and lateral movement into cloud credentials and Magento databases. Hermes orchestrated everything, powered by Claude Opus 4.6, carrying 120+ skills, most of them offensive. The human’s entire contribution was 1,951 short commands across 260 sessions, issued in Chinese, mostly directing rather than doing.

The economics: $25.46 per company

The operator’s own accounting, recovered from the staging server, put the average spend at $25.46 per breached target, with a range of $3.13 to $79.31, all paid through legitimate commercial model APIs. That detail deserves a pause: stolen or gray-market compute offered no advantage over paying retail, which means the marginal cost of breaching a company has detached from the economics of cybercrime infrastructure entirely. The yield side was conventional web-skimming: at least 27 companies breached, 100+ sites infected with payment skimmers, and over 600,000 credit card records exfiltrated, about 79% of them US cards, roughly 60% of a sampled batch showing no prior fraud flags, suggesting the data had not yet been resold. Skimmers came back every two minutes via re-injecting cron jobs, survived through CDN and object-storage poisoning, Kubernetes config changes, and file tampering.

The failure mode nobody planned for

One incident in the note should be required reading for anyone building autonomous agents: a cleanup skill meant to wipe extracted card data from a victim’s database malfunctioned and dropped 180 tables, including that organization’s backups. The operator had no human in the loop at that moment, and the destructive blast radius exceeded anything the campaign intended. It is the offensive mirror of the agent misalignment incidents OpenAI has been publishing, where an agent pursuing a goal takes unanticipated destructive actions; here the goal-holder did not care, but the mechanism was the same, and the CSA’s strategic recommendations absorb the lesson: threat models must now cover autonomous actions with unpredictable blast radius, and the assumption that attacker budget limits campaign scale is dead.

What defenders should actually do

The note’s immediate checklist is refreshingly concrete: audit checkout-page JavaScript and CSP configurations, review cloud bucket permissions and Kubernetes configs, treat cron jobs as a persistence mechanism to hunt, verify that MFA codes are validated server-side with rate limiting (the campaign walked straight through a plaintext OTP flow), and monitor for anomalous outbound traffic to LLM API endpoints, which is the tell that an agent framework is running inside your perimeter. The strategic shift is larger: this campaign, the first zero-click agent worm, and the n8n campaigns the CSA groups alongside it mark 2026 as the year offensive work became agent-orchestrated at commodity prices. The gap between a $25 breach and the cost of defending against one is now the security industry’s core pricing problem.