Agent intrusions go retail: detection and hunting experience
Agentic Intrusion Goes Retail: Detection and Hunting Lessons
From September to October 2026, financially motivated attackers used open-source agent frameworks such as Cairn, Hermes and Strix to launch hundreds to thousands of attack projects in parallel against e-commerce and payment sites, with model costs per attempt averaging about $5 to $25. The Cloud Security Alliance, synthesizing three reports from NorForge, SOCRadar and Gambit, notes that operators only select targets and write down objectives (for example, unauthorized remote code execution), while reconnaissance, vulnerability iteration and validation are left to agents; NorForge estimates an average success rate of about 10% and considers covering thousands of targets at a cost of a few dollars each economically worthwhile. SOCRadar recorded CyberXero using 51 dedicated Claude Code agents in a single automated WordPress exploitation to scan 4,708 targets, confirm 429 admin panels and deploy 32 web shells within 61 seconds.
The article summarizes three reports from NorForge, SOCRadar, and Gambit, outlining the cost structure of attackers using open-source agent frameworks to mass-compromise e-commerce, and provides a hunting hypothesis table that can be directly checked against logs.