Skip to content
NewsIncident

A Chinese-speaking hacker weaponized an open-source AI pentest tool to breach 100+ companies at $50 each

· by Pondero Newsdesk

The short version

A researcher found exposed control panels showing one operator's AI agent breached more than 100 companies out of 1,200+ targeted sites, at roughly $50 in AI costs per successful hit.

A Chinese-speaking hacker weaponized an open-source AI pentest tool to breach 100+ companies at $50 each

A security researcher found unsecured control panels online belonging to a Chinese-speaking criminal operator who pointed Cairn, an open-source AI agent built for authorized penetration testing, at more than 1,200 company websites starting September 25, 2026, breaching upward of 100 of them for about $50 in AI costs per successful hit, per Reuters' review of the attacker's own records as reported by The Hacker News.

What

The operator ran Cairn, a tool built by a developer who posts as le1xia0, paired with a logged setup called "claudecode_deepseek-v4.1-flash": Anthropic's Claude Code driving a DeepSeek V4.1 Flash backend, per The Hacker News. Targets spanned the United States, Canada, Australia, and Japan. Snorre Fagerland, a principal threat researcher at NorForge, discovered the campaign by locating exposed Cairn dashboards on the open internet; the busiest cluster his team labeled AIA0001 linked 14 control panels to more than 1,100 attack projects, according to CyberSecurityNews and The Hacker News' account of the Reuters reporting. Confirmed victims named in the records include Deere, SharkNinja, and Cummins.

The attacker's own cost logs, reviewed by Reuters, put the success rate at roughly 10%, the average time to compromise a site that fell at just under 23 hours, and total spend near $5,000 in AI tokens, which works out to about $50 per confirmed breach and closer to $5 per attempted task once failures are averaged in, per CyberSecurityNews' account of the figures.

Exposed control panels, not a new exploit, gave the campaign away

Fagerland's team found this operation only because the attacker made the exact mistake his own agents were sent out to find in victims: an administrative panel sitting on the open internet with no login wall. That symmetry is the real lesson, not any new AI capability. Nothing else about the attack chain was novel: a pentesting agent meant for defensive use, a mainstream coding agent, and a cheap backend model, strung together and left running with minimal human input. The operator reportedly gave the agents their marching orders in under 100 Chinese characters and let them handle reconnaissance, exploitation, and follow-through on their own. The price floor matters too: a criminal with roughly $5,000 in token budget, per the same cost logs, and no apparent coding background cleared a one-in-ten hit rate against household-name industrial and consumer brands inside a day per successful target. If your organization exposes any agent or pentest-tool dashboard to the open internet, put it behind authentication now. That is literally the only thing that caught this operator.

What to watch next

Check now whether your own agent-tooling or pentest dashboards are indexed or reachable without a login: that is the same exposure that unmasked this operator. Beyond that, watch whether le1xia0 adds abuse-prevention gates to Cairn or restricts its distribution following the disclosure, and whether Deere, SharkNinja, Cummins, or any of the other confirmed victims issue formal breach notifications once applicable disclosure deadlines pass.

Sources