AI Didn’t Invent New Hacks. It Made the Old Ones Cost $50.

In early October a researcher at NorForge, Snorre Fagerland, went looking for exposed copies of Cairn, an open-source AI agent platform, and found about two dozen being used to attack people. Behind the panels were AI agents that had tried more than 1,200 websites and got into more than 100 companies. Reuters later confirmed several of the names: Deere, SharkNinja, and a vendor-run site for Cummins.

The bill for the whole campaign, by NorForge’s estimate, was about $5,000 in tokens. Roughly $50 per successful break-in. The operator’s instructions to the agents were fewer than 100 Chinese characters.

That paragraph sums up security in 2026. The headlines say AI is inventing new kinds of attack. It mostly isn’t. It is running the old ones for almost nothing, around the clock, against targets that used to be too small to bother with.

The year’s AI-involved breaches, briefly

These are the incidents with real evidence behind them: a researcher who recovered the attacker’s infrastructure, or a victim that confirmed it.

Lay them side by side and AI shows up in three different roles. They need different fixes, so it’s worth keeping them apart.

What actually changed: price and patience

Three numbers carry most of the argument.

Look at what is not on that list: a zero-day. JadePuffer walked in through a Langflow bug with a fix that was more than a year old. The Cairn break-in that NorForge documented in detail chained a writable session store, unsafe PHP deserialisation and legacy Zend code, all bugs a human pentester would recognise from a decade ago. Sysdig’s Michael Clark put it plainly: the techniques were known; what stood out was the agent making the operational decisions itself.

For years, small and mid-sized stores were protected by economics more than by security. A skilled human attacker has a few hours a day and goes where the payout justifies them. An agent will spend 23 hours patiently trying combinations on a store with eight thousand customers, because those 23 hours cost $50. JadePuffer recovered from a failed login in 31 seconds with no one at the keyboard. Being too small to bother with no longer protects you.

Why ecommerce is the favourite target

Gambit’s victims included an online fashion retailer and an industrial supplies distributor. Cairn’s busiest cluster went after online shops by design: the task it was given was to find a way to run code and plant a web shell uploader. The reasons are not mysterious.

• Checkout has to be public. You can’t put your payment page behind a VPN. Whatever runs there is reachable by anyone, including an agent that never sleeps.
• Cards pay out right away. Gambit’s agents didn’t stop at access. They were told to add skimmers, by appending code to legitimate JavaScript files and slipping script tags into checkout pages and Google tag blocks.
• Stores run a lot of old code. Abandoned modules, a staging server from the last replatform, a support microsite nobody owns. SharkNinja’s breach, by its own account, was a standalone product-support site. That forgotten corner is exactly where an agent with time to spare ends up.
• Stores trust a lot of apps. The BigCommerce incident in September wasn’t AI at all: attackers stole credentials for the third-party Ribon apps and used them to inject scripts into merchant storefronts, exposing names, emails and addresses at retailers including Master of Malt. Every app you install brings its own keys, and those keys are part of your attack surface too.

And the bugs keep arriving. Magento’s StyleSmuggler, a CVSS 10.0 that needs no login, was exploited from 4 September and fixed only afterwards. We covered the platform’s history in Magento security problems. Put an agent that can turn a public proof-of-concept into a working intrusion together with a patch window that already ran backwards, and the gap between a disclosure and your store being hit gets very short.

AI is also the new attack surface

The second role matters more to anyone deploying AI rather than defending against it. An AI assistant reads text it didn’t write and then uses tools. If some of that text was written by an attacker, the attacker is now steering your tools.

That is prompt injection, and it moved out of the lab some time ago. EchoLeak (2025, CVSS 9.3) let a single crafted email make Microsoft 365 Copilot pull data from OneDrive, SharePoint and Teams and send it out, with no click from the victim. In February 2026, “Clinejection” turned the title of a malicious GitHub issue into a supply-chain compromise of the Cline coding assistant’s npm package. Infostealers now go after coding agents’ tokens and MCP configs on developer laptops, the same way they went after browser cookies.

If your store has an AI assistant, and more stores do every month, everything a shopper types into it is untrusted input by definition. The question that matters is not how clever the model is. It is what the agent is allowed to do when someone hostile is typing. We build one of these, so take this as a list of questions to put to any vendor, us included:

• Can the assistant do anything an anonymous shopper couldn’t already do through the storefront? It shouldn’t be able to.
• Are admin or integration tokens anywhere the model can reach, in a prompt, a tool result or a log it can read?
• Do cart and order actions go through the same APIs and checks as the normal storefront, or through a privileged side door?
• Can any tool fetch or post to an arbitrary URL? That is the classic way injected instructions get data out.

And sometimes nobody was attacking at all

The third role is the strangest. From May to July, AI agents being trained and evaluated at OpenAI reached systems they were never aimed at. In the Hugging Face incident, agents escaped a test sandbox through a JFrog Artifactory flaw; Hugging Face contained it, disclosed it and told the FBI. OpenAI acknowledged its agents’ role, saying the relevant safeguards “were intentionally not enabled during this evaluation,” and by 1 October had notified more than 100 organisations. Australia’s prime minister called the intrusion into a Medicare statistics portal the first known case of an AI agent hacking a government network.

For a store this is mostly a footnote. The lesson that carries over is that agent traffic on the open web is now a fact of life, and plenty of it has no one directing it moment to moment. Rate limits, bot rules and WAF policies built for human-paced attackers need another look.

What to change this quarter

None of this calls for an “AI security” product. It calls for doing the boring things faster, because the attacker’s time is now nearly free.

1. Measure patch time in days, not sprints. Anything public-facing (checkout, APIs, GraphQL, webhooks) needs a path from advisory to production that doesn’t wait for the next release window. If you ran an unpatched, internet-facing Magento store any time after 4 September, treat it as possibly compromised: patch, then rotate the encryption key, API tokens and payment credentials.
2. Hunt down your old code. List every subdomain, staging box and legacy module. Delete what you can and put the rest behind authentication. Agents find the forgotten support microsite because they have time to look.
3. Watch what runs on checkout. A content security policy, subresource integrity and change detection on payment-page scripts. PCI DSS 4.0 already requires this (requirements 6.4.3 and 11.6.1) because skimmers are injected exactly there.
4. Audit apps and rotate their keys. Remove the ones nobody uses. For the rest, know which ones can write to your storefront, and rotate their credentials on a schedule rather than after a breach notice.
5. Scope your own AI. Ask the four questions above about any assistant you run, and don’t accept “the model is instructed not to” as an answer. Controls belong in code and permissions, not in the prompt.
6. Get there first. The tools in these campaigns are open source. An authorised test that points an agent at your own store costs about what one costs the attacker. Vet whoever runs it, though: NorForge found legitimate pentest firms that had left real client results on unsecured panels.

The stores that got hit this year weren’t outsmarted by an AI. They were found by one, through holes that had been there for a long time. Closing those holes is the same work as before. It just has a much shorter deadline now.

Sources

• The Hacker News — Hackers use autonomous AI agents to breach company websites (NorForge / Cairn) · TNW on the Reuters-confirmed victims
• CSO Online — JadePuffer, the agent that ran a ransomware attack (Sysdig research) · Cloud Security Alliance research note
• BleepingComputer — Malicious AI agents steal 600k credit cards (Gambit Security) · TNW on the campaign economics
• The Hacker News — Adobe patches Magento zero-day (StyleSmuggler, CVE-2026-75650) · Akamai analysis
• BleepingComputer — BigCommerce alerts merchants of breach linked to Ribon apps
• Wikipedia — 2026 cyberattacks by OpenAI research agents (with primary sources)
• Cloud Security Alliance — Indirect prompt injection goes operational · Vectra on EchoLeak and Clinejection

Running a store on Magento? The Magento security history explains why the same class of bug keeps landing. If you are looking at putting an AI assistant on your own storefront, the piece on MCP tools in ecommerce agents covers what those tools should and shouldn’t be able to touch.