Hackers Are Delegating the Break-In. Here's What AI Changes.

The affected website carried product-support information. SharkNinja said the threat had been contained. Deere reported remediation and no indication that sensitive information had been accessed. Cummins was investigating a potential attack on a website run by a supplier.

Those were the company responses in Reuters' October 19 investigation into a campaign reportedly targeting more than 1,200 sites and reaching websites belonging to more than 100 companies. Reuters independently reviewed attacker activity to identify victims, but could not establish the extent of data extraction. Two smaller businesses acknowledged compromise.

The unusual part was the division of work: a person assigned the targets, while AI agents spent hours pursuing ways inside. NorForge principal threat researcher Snorre Fagerland estimated about $5,000 in model tokens across the campaign, or roughly $50 per successful intrusion. Those figures were estimates, not a complete criminal operating budget.

The story deserves attention even without the bargain price tag. Agents are moving beyond advising an attacker toward doing extended operational work. That creates a different question for businesses: how much investigation can an adversary afford to spend on them when it no longer requires constant human attention?

A target, a goal, and workers that keep going

NorForge's investigation found more than 20 exposed Cairn control panels assessed as likely malicious. One activity cluster linked 14 panels to over 1,100 attack projects. A project gives agents a starting point and objective; workers share findings, and a human can contribute hints.

NorForge validated selected intrusions. Successful projects in the busiest cluster averaged just under 23 hours from start to goal. Its approximate 10% success estimate spans different goals and is not a universal breach rate. The researchers lacked actual token totals and estimated about $5 per task, including unsuccessful and early-ending work, with considerable uncertainty.

That is the useful distinction between an assistant and an agent. Advice leaves a person to perform the next step. An agent can use tools, examine the response and choose another step toward its assigned objective. The operator remains responsible for choosing and directing the malicious job.

Read that way, autonomy is a description of a handoff. It does not require a machine to invent its own criminal ambitions. Nor does it establish that every result the machine reports is true. A completed task, unauthorized access and stolen customer data are three different outcomes.

A second campaign shows what that work can produce

Gambit Security's separate investigation recovered an operator's staging-server material. It reports 105 attack projects launched between September 10 and 15, at least 27 companies compromised to varying degrees, and more than 600,000 card records taken from two companies. Its evidence combines recovered data, live checks and logs; some agent claims were credited without independent verification. Fifty-seven projects had been deleted.

The spending evidence has different parts. A captured account balance recorded $7,005.71 spent over four weeks. The operator's own cost review averaged $25.46 across 101 completed scans, ranging from $3.13 to $79.31. Gambit extrapolated $12,000-$18,000 for a longer period. These windows do not provide an audited cost per successful breach.

The person was still involved: Gambit counted 1,951 human prompts across 260 sessions. This is evidence of extensive delegation, not the disappearance of an operator. No attribution establishes that this operator and NorForge's busiest cluster were the same.

What the small bill actually buys

A cheap attempt and a cheap successful intrusion are different propositions. So are a model bill and the cost of running a criminal operation. The figures become more useful when they retain their original units.

Hosting, tools, preparation, human direction and the work of turning access into money also belong in a full account. A narrow model-spending figure does not tell us their price. Without a comparable human-only campaign, it cannot tell us how many salaries or hours were replaced.

The economic possibility is still consequential. If an operator can delegate a prolonged investigation at low additional model expense, pursuing another target may become worthwhile. That is an inference from the operating model, not a measured conclusion that all businesses have become cheaper to attack.

For a shop owner, the important number is unlikely to be the adversary's token bill. It is the disruption that access could cause: whether orders can continue, whether customer information remains protected and whether the business can recover. The two sides are paying for different things.

The wider evidence supports a shift, with humans still involved

Microsoft's 2026 Digital Defense Report overview describes AI use across reconnaissance, vulnerability research and post-compromise activity. It explicitly cautions that most complex real-world intrusions still involve meaningful human direction. Its 32-stage attack-chain result was a controlled evaluation, not a criminal campaign.

That qualification matters. A lab can demonstrate a capability. A real incident can demonstrate that someone used it. Neither tells us how common it has become across cybercrime.

Anthropic's November 2025 investigation described roughly 30 targets and a handful of validated intrusions in an espionage campaign. Its estimate that AI performed 80-90% of tactical work comes from its own analysis, not an independent labor audit. Human operators retained strategic decisions. The company also reported false findings and fabricated credentials, which complicated the attacker's work.

Its September 2026 report describes broader adoption of orchestration and direct execution across the actors it investigated. Anthropic explicitly presents notable, novel cases rather than a representative sample of typical misuse. These are separate vendor investigations, not independent confirmation of the Cairn campaign.

Our assessment is that the evidence supports a change in how substantial parts of attacks can be organized. It remains too patchy to turn selected operations into a reliable count of AI attacks worldwide.

A small attacker bill can still leave an expensive problem

Australia's latest ASD cyber threat report records average self-reported business losses of A$93,500 per cybercrime report, up 16%. That is broader cybercrime reporting, not a measure of damage from AI attacks. It cannot be placed beside one campaign's model costs to calculate an AI-driven rise in harm.

The measurement problem is larger than this story. A GovAI technical report finds cybercrime-damage data too incomplete and ambiguous to directly detect incremental AI-driven increases. Its authors also caution that defensive adaptation complicates the net effect. More capable attackers do not automatically establish that society's overall losses are rising because of AI.

None of that makes a confirmed intrusion trivial. It means the honest account follows the harm that can be established, while leaving the global extrapolation open. A compromised support site and hundreds of thousands of stolen payment records should not collapse into the same headline outcome.

The attackers' tools became targets too

NorForge's October 26 follow-up found malicious tasks inserted into at least 17 exposed Cairn panels. The intruders sought secrets, including AI credentials, and attempted to establish further access. Some panels appeared to belong to legitimate security users. Possessing capable agents had not protected the people running them from exposed infrastructure.

Separately, Railway disclosed unauthorized access to internal systems and exposure of customer secrets. Its preliminary investigation says the attacker sought AI-provider keys for distillation, which uses model outputs to develop another model. That motive remains Railway's assessment; there is no established attribution linking these incidents.

This is a second dimension of AI security: the systems that let agents work can hold valuable access themselves. Criminals using AI and criminals stealing access to AI are related subjects, but they are not interchangeable explanations of an incident.

Defenders can delegate useful work as well

The DARPA AI Cyber Challenge demonstrated automated discovery and patching. Its corrected final results report 54 synthetic vulnerabilities found and 43 patched, alongside 18 real vulnerabilities discovered and 11 patches supplied. These competition results establish useful defensive capability, not guaranteed repairs across production systems.

OpenSSF describes subsequent work validating findings and proposed patches before handing them to maintainers. That step matters: a proposed repair has to preserve legitimate behavior as well as block an attack. PatchBench research warns that checking only whether a known demonstration still crashes can overstate patching success.

There are also opportunities to stop the attack before a repair is needed. In Silverfort's contained lab tests, stronger identity controls stopped the agent's objective on a rerun. That is a bounded vendor demonstration, but it illustrates why more persistence does not create access where correctly enforced controls deny it.

Choosely's PHP2Shell investigation follows the difficult journey from discovery to deployed protection. For the business relying on that software, somebody still needs to own the update, access restrictions and recovery plan. An owner using a managed platform can start by asking the responsible host what is affected and what has been done.

Choosely's verdict

AI agents can now take on substantial operational work in documented malicious campaigns. The significant development is the ability to delegate an extended attempt, check its progress and pursue other work while it continues. Low reported model spending helps explain the attraction, although total costs and labor savings remain uncertain.

For businesses, that raises the value of removing easy routes in and preparing to recover when prevention fails. For everyone following AI, it is a concrete example of the same delegation that makes agents useful at work becoming useful to adversaries. Understanding who sets the goal, what the machine can do and where access is enforced tells us more than another claim that a hack costs $50.