$50 per intrusion: detecting autonomous agent intrusion campaigns
Fifty Dollars per Breach: Detecting Autonomous Agent Intrusion Campaigns
On October 19, 2026, Reuters and security firm NorForge disclosed that a Chinese-speaking operator used the open-source multi-agent platform Cairn to attempt intrusions against more than 1,200 websites; Reuters, after reviewing the operator's records, confirmed that more than 100 company sites were breached, including those of Deere, SharkNinja and Cummins, but could not determine whether any data was stolen. NorForge researchers estimated the operator's model costs at about $5,000, roughly $50 per successful intrusion; their report separately estimated about $5 per task and noted substantial uncertainty. Previously, in September, Gambit Security disclosed that a similar agent combination using Cairn as its exploitation engine breached at least 27 companies and stole records of more than 600,000 unexpired payment cards.
Two disclosures show that the cost of a single agent intrusion has reached tens of dollars, with success achieved in less than a day on average, which defenders can use to rearrange detection time limits and the scope of asset inventories.