Latest / DX Today | No-Hype Podcast & News About AI & DX / One Hacker, AI Agents and $50 Break Ins at 100+ Companies

Transcript

One Hacker, AI Agents and $50 Break Ins at 100+ Companies · DX Today | No-Hype Podcast & News About AI & DX

• 0:00
  SPEAKER_01: Welcome to the DX Today Podcast, your daily deep dive into the AI ecosystem.
• 0:05
  SPEAKER_01: I'm Brian, and joining me as always is Jessica.
• 0:08
  SPEAKER_00: Thanks, Brian.
• 0:09
  SPEAKER_00: Today we are digging into a story that a lot of security people have been dreading for a while, because it suggests the era of the fully delegated cyber attack has quietly arrived.
• 0:19
  SPEAKER_01: Right, this is the Reuters exclusive that landed on October 19th.
• 0:22
  SPEAKER_01: The short version is that one hacker handed most of the work to AI agents and broke into websites at more than 100 companies.
• 0:30
  SPEAKER_00: And the part that made me sit up was the price tag.
• 0:32
  SPEAKER_00: The researcher who tracked this estimates the whole campaign cost about$5,000 in tokens, which works out to roughly$50 per successful break-in.
• 0:42
  SPEAKER_01: $50 is less than a nice dinner for two.
• 0:45
  SPEAKER_01: So before we get into what that means, walk us through who found this because the way it was discovered is a story all by itself.
• 0:52
  SPEAKER_00: The researcher is Snorr Fagerland, a principal threat researcher at a Norwegian security firm called Norforge.
• 0:59
  SPEAKER_00: He was scanning the internet for copies of an open source agent platform called Cairn that people had accidentally left exposed to the public.
• 1:06
  SPEAKER_01: So the attackers essentially left their workshop door open, and a researcher walked by and could watch the tools working through the window step by step in real time.
• 1:15
  SPEAKER_00: That is exactly what happened.
• 1:17
  SPEAKER_00: Starting around October 2nd, he found about two dozen of these exposed setups being used for malicious work, and he could follow each agent as it planned, probed, failed, and tried again.
• 1:27
  SPEAKER_01: And the most active operator among them, according to Reuters, was a Chinese-speaking hacker who started on September 25th.
• 1:34
  SPEAKER_01: What were they actually going after with all of these agents?
• 1:37
  SPEAKER_00: Online stores, mostly.
• 1:39
  SPEAKER_00: The targets were retail and shopping websites in the United States, Canada, Australia, and Japan.
• 1:46
  SPEAKER_00: And by late last week, the agents had attempted to break into more than 1,200 sites.
• 1:50
  SPEAKER_01: 1,200 attempts and more than 100 successes.
• 1:53
  SPEAKER_01: That is a hit rate somewhere around one in 12, which honestly sounds about like a decent cold-calling campaign.
• 2:00
  SPEAKER_01: Just point it at your servers.
• 2:01
  SPEAKER_00: And why online stores in particular?
• 2:03
  SPEAKER_00: They tend to run on a patchwork of plugins, payment pages, and old promotional sites, which gives an automated attacker a lot of surface area to explore without much effort.
• 2:13
  SPEAKER_01: Plus, they hold exactly what criminals want, which is customer accounts, addresses, and sometimes payment details.
• 2:19
  SPEAKER_01: So it is a sensible target list, even if it was chosen by a person and then executed by machines.
• 2:26
  SPEAKER_00: Going back to your cold calling comparison, it is darker than you probably intended, but it is accurate.
• 2:31
  SPEAKER_00: And the instructions the operator gave were tiny.
• 2:34
  SPEAKER_00: Reuters says the preferred tactics were written in fewer than 100 Chinese characters, roughly a short paragraph.
• 2:41
  SPEAKER_01: That is the detail I keep coming back to.
• 2:43
  SPEAKER_01: A short paragraph of guidance, and then the agents go off and grind for hours on their own.
• 2:49
  SPEAKER_01: How long did a typical successful intrusion take?
• 2:52
  SPEAKER_00: About 23 hours of probing, on average, for the ones that worked.
• 2:56
  SPEAKER_00: Which tells you something important, because no human attacker is going to sit there for a full day poking patiently at one mid-sized store website.
• 3:04
  SPEAKER_01: And that is really the economic shift here.
• 3:07
  SPEAKER_01: Patience used to be expensive.
• 3:09
  SPEAKER_01: You paid a skilled person by the hour, so attackers only spent that patience on targets that looked valuable enough to justify it.
• 3:16
  SPEAKER_00: Now patience costs pennies per minute.
• 3:19
  SPEAKER_00: So the long tail of companies that were never worth a human attacker's time, the regional retailer or the product support site, suddenly becomes worth an agent's time.
• 3:29
  SPEAKER_01: Let's talk about the models because people will want to know.
• 3:32
  SPEAKER_01: Fagerland told Reuters the campaign appeared to mix the Chinese model DeepSeek with Claude Code, the coding agent from Anthropic.
• 3:39
  SPEAKER_00: Which is notable because Anthropic has published its own reports on misuse before.
• 3:44
  SPEAKER_00: Last year it described a single operator who used Claude Code to compromise at least 17 organizations in about a month in an extortion scheme.
• 3:52
  SPEAKER_01: So this is not the first warning sign, but the difference this time, as I read it, is how little steering the human did.
• 3:59
  SPEAKER_01: The earlier cases still had a person making a lot of the calls.
• 4:02
  SPEAKER_00: That is the shift Fagerland himself described.
• 4:05
  SPEAKER_00: He told Reuters he had previously assumed hacking agents would still need a fair amount of supervision, and that it was now clear the technology had moved past that point.
• 4:14
  SPEAKER_01: He also had a couple of very quotable lines.
• 4:16
  SPEAKER_01: One was simply, it's a new world now.
• 4:19
  SPEAKER_01: And the other was, it's not script kiddy stuff, which is security slang for amateurs running borrowed tools they barely understand.
• 4:26
  SPEAKER_00: And there is one example in the reporting that explains why he said that.
• 4:30
  SPEAKER_00: It involves a large company which Reuters did not name, and it shows the agents doing something that looks a lot like real creativity.
• 4:37
  SPEAKER_01: Go ahead and walk us through it, because I think this is the part that matters most for anyone who actually runs systems and has to defend them on a normal Tuesday morning.
• 4:46
  SPEAKER_00: The agents first attacked the company's main public application and could not find a weakness.
• 4:51
  SPEAKER_00: Instead of giving up, they searched public digital records for related infrastructure, and they found a control panel that was reachable from the open internet.
• 4:58
  SPEAKER_01: The Forgotten Side Door.
• 5:00
  SPEAKER_01: Every company I have ever worked with has at least one of those.
• 5:03
  SPEAKER_01: Some admin page a contractor stood up years ago that nobody remembers is still running.
• 5:08
  SPEAKER_00: Then the agent spotted a subtle flaw in how that panel processed data, and after hours of trial and error, they tricked the server into running their own commands.
• 5:17
  SPEAKER_00: Bagerland said, it is not straightforward to come up with solutions like that.
• 5:21
  SPEAKER_01: That is what a good penetration tester does.
• 5:24
  SPEAKER_01: They don't break down the front door, they walk around the building looking for the window someone left open.
• 5:30
  SPEAKER_01: Now an agent does that walk for$50.
• 5:33
  SPEAKER_00: So let's name the victims we know about.
• 5:35
  SPEAKER_00: Reuters did its own review of the operator's activity and identified three well-known companies among those affected, which were Deer, Shark Ninja, and Cummins.
• 5:45
  SPEAKER_01: The tractor company, the kitchen appliance company, and the engine company.
• 5:49
  SPEAKER_01: Not exactly the usual suspects when people picture a big cyber attack.
• 5:54
  SPEAKER_01: What did each of them say when Reuters reached out for comment?
• 5:57
  SPEAKER_00: Deer said it took the necessary remediation actions and had no indication that sensitive information was accessed.
• 6:04
  SPEAKER_00: Shark Ninja said the intrusion hit a standalone site holding only product support information and that the threat was contained.
• 6:11
  SPEAKER_01: And Cummins said it was investigating a potential attack on a website that is run by a third-party vendor.
• 6:17
  SPEAKER_01: Which is its own lesson, because your exposure now includes every site a supplier runs with your name on it.
• 6:23
  SPEAKER_00: Two smaller businesses also acknowledged being compromised, and many of the other victims simply did not respond.
• 6:35
  SPEAKER_01: I want to be fair here, because skepticism is healthy.
• 6:38
  SPEAKER_01: A product support site getting hit is not the same as a bank vault getting cracked.
• 6:43
  SPEAKER_01: Some of these break-ins may have touched very little of real value.
• 6:47
  SPEAKER_00: That's fair, but I'd push back a bit.
• 6:50
  SPEAKER_00: The point is not the value of any single site.
• 6:54
  SPEAKER_00: The point is that the cost of trying has collapsed, so attackers can afford to sweep everything and keep whatever turns out to be worth keeping.
• 7:01
  SPEAKER_01: That is a good correction.
• 7:02
  SPEAKER_01: It's a volume business now.
• 7:04
  SPEAKER_01: And Fagerland saw other actors doing worse things with the same kind of setup, right?
• 7:09
  SPEAKER_01: This was not just one person in the data.
• 7:11
  SPEAKER_00: Right.
• 7:12
  SPEAKER_00: He said one other actor used agents to steal a large trove of credit card data, and another tried to use them to rob a cryptocurrency exchange.
• 7:21
  SPEAKER_00: Reuters did not give figures for either of those cases.
• 7:24
  SPEAKER_01: And this lines up with other recent reports.
• 7:27
  SPEAKER_01: The Israeli firm Gambit Security documented a Russian-speaking extortion crew using an AI coding tool called Cursor against seven organizations back in August.
• 7:37
  SPEAKER_00: And then in September, Gambit described a spree that breached 25 companies and stole at least 600,000 credit card records.
• 7:45
  SPEAKER_00: Meanwhile, the firm BitSite says chatter about autonomous agents on criminal forums has surged.
• 7:51
  SPEAKER_01: So we have a pattern, not an anecdote.
• 7:53
  SPEAKER_01: Let me ask the practical question, Jessica.
• 7:55
  SPEAKER_01: If I am running security at a mid-sized retailer, what actually changes for my team on Monday morning because of this story?
• 8:02
  SPEAKER_00: The first thing is your inventory.
• 8:04
  SPEAKER_00: The agent in that example won by finding infrastructure the company forgot it had.
• 8:09
  SPEAKER_00: If you do not know every internet-facing system with your name on it, an attacker's agent will find it before you do.
• 8:15
  SPEAKER_01: And I would add, include your vendors in that inventory.
• 8:18
  SPEAKER_01: The Cummins case is a reminder that the site that gets breached may not even be one your own team built, but it is still your brand on the front page.
• 8:27
  SPEAKER_00: Second, think about the time signature of these attacks.
• 8:30
  SPEAKER_00: 23 hours of patient, steady probing looks different from a human burst.
• 8:35
  SPEAKER_00: Monitoring that looks for slow and persistent automated testing becomes much more valuable now.
• 8:41
  SPEAKER_01: Third, and this one is a little uncomfortable, use the same tools on yourself.
• 8:46
  SPEAKER_01: If an agent can probe your sites for$50, you can pay$50 to have a friendly agent probe them first and tell you what it finds.
• 8:54
  SPEAKER_00: I like that.
• 8:55
  SPEAKER_00: And I would add a fourth point about your own AI tools.
• 8:59
  SPEAKER_00: This whole campaign was exposed because attackers left their agent platform open to the internet, and plenty of legitimate companies are making that exact same mistake right now.
• 9:08
  SPEAKER_01: That is a great point.
• 9:10
  SPEAKER_01: Every team experimenting with agents is standing up new dashboards, new servers, and new keys.
• 9:16
  SPEAKER_01: If those are left reachable from the internet, you have just built the next forgotten side door yourself.
• 9:22
  SPEAKER_00: And the irony would be painful.
• 9:24
  SPEAKER_00: The same mistake that let Faggland watch the criminals could let criminals watch or even hijack.
• 9:29
  SPEAKER_00: The agents that a perfectly honest company is using to run its own business.
• 9:33
  SPEAKER_01: So treat agent infrastructure like production infrastructure from the very first day with real authentication, real logging, and somebody whose actual job it is to know that it exists and is locked down properly.
• 9:45
  SPEAKER_00: Anthropic actually announced something in that spirit this week.
• 9:48
  SPEAKER_00: A free scanner that runs periodic vulnerability checks for critical open source projects.
• 9:53
  SPEAKER_00: And Microsoft rolled out controls that let administrators restrict or shut down individual agents.
• 9:59
  SPEAKER_01: Which brings up the policy angle.
• 10:01
  SPEAKER_01: And I suspect you have opinions.
• 10:03
  SPEAKER_01: Who is responsible when a commercial coding agent ends up doing the legwork for a criminal campaign like this one?
• 10:09
  SPEAKER_00: It's a hard question.
• 10:10
  SPEAKER_00: The model makers have usage policies and abuse detection, but this campaign reportedly mixed in an open weight model, Deep Seek.
• 10:17
  SPEAKER_00: And you cannot recall or monitor a model once its weights are downloaded and running on someone's own hardware.
• 10:22
  SPEAKER_01: And the platform in the middle, Cairn, is open source too.
• 10:26
  SPEAKER_01: Its author told Reuters it was not designed for hacking attacks, which I believe, but the same could be said of a lot of very useful tools.
• 10:34
  SPEAKER_00: Exactly.
• 10:35
  SPEAKER_00: And that is the dual use problem in a nutshell.
• 10:38
  SPEAKER_00: The capability that lets a defender audit a thousand sites overnight is the same capability that lets an attacker break into a hundred of them for the price of a used laptop.
• 10:47
  SPEAKER_01: So if regulation is not a quick fix, the money question is who pays?
• 10:51
  SPEAKER_01: Do you think this shows up in insurance premiums, in vendor contracts, or somewhere else first?
• 10:57
  SPEAKER_00: I'd bet on insurance first.
• 10:59
  SPEAKER_00: Cyber insurers' price risk on how likely an attack is and how much it costs.
• 11:03
  SPEAKER_00: And both numbers just moved in the wrong direction.
• 11:06
  SPEAKER_00: Expect much tougher questionnaires about exposed systems and agent monitoring at renewal time.
• 11:11
  SPEAKER_01: That would actually be a healthy outcome if it forces companies to finally clean up all those forgotten admin panels and old marketing sites that have been quietly sitting out there for years.
• 11:20
  SPEAKER_00: And the second order effect is on small businesses.
• 11:23
  SPEAKER_00: A big company can absorb a security team.
• 11:25
  SPEAKER_00: A 20-person online shop cannot.
• 11:28
  SPEAKER_00: And those are exactly the targets that just became worth attacking for the very first time.
• 11:32
  SPEAKER_01: So the honest takeaway for me is this: the attack itself is not magic.
• 11:37
  SPEAKER_01: It is the same old bugs and the same old forgotten doors.
• 11:40
  SPEAKER_01: What changed is that searching for them no longer needs a skilled human.
• 11:44
  SPEAKER_00: And my takeaway is that the defenders need to adopt the same economics before the attackers fully scale.
• 11:50
  SPEAKER_00: If finding a weakness costs$50 for a criminal, it should cost$50 for you too.
• 11:56
  SPEAKER_00: And you should find it first.
• 11:58
  SPEAKER_01: Well said.
• 11:59
  SPEAKER_01: We will keep watching how the model makers, the insurers, and the regulators respond, because I suspect this Reuters report is going to be cited in a lot of board meetings over the next few months.
• 12:09
  SPEAKER_01: That's all for today's episode of the DX Today podcast.
• 12:12
  SPEAKER_01: Thanks for listening, and we'll see you next time.