N012: One hacker's AI agents broke into 100+ sites at $50 each
A single attacker's AI agents, run from exposed Cairn control panels, got into websites at 100+ companies for about $50 a success; DHS orders DeepSeek and products built on it off federal civilian systems; Codex CLI checks its sandbox before every command.
N012 · Tuesday 20 October 2026 · 5-min read · Covers 19 Oct 04:00 PT to 20 Oct 04:00 PT
Jump to: Incidents · Threats · Policy · Architecture · Models & infrastructure · Tools & defenses · Pro deep dives
Today in 30 seconds
- One attacker ran more than 1,100 intrusion projects from Cairn agent control panels left open on the internet, and Reuters says the agents got into websites at more than 100 companies, including Deere and SharkNinja.
- NorForge says the agents ran on a worker labeled "claudecode_deepseek-v4.1-flash", which it reads as a Claude Code harness driving DeepSeek's low-cost model, at about $5 a task.
- DHS ordered civilian agencies to remove DeepSeek products and third-party products "developed using DeepSeek implementations", so which model sits inside your agents is now a procurement question.
Top story
One attacker's AI agents got into 100+ companies' websites from exposed control panels
19 Oct 2026 · NorForge (primary); Reuters via TNW · Incident · no CVE · Relevance 10
One person gave AI agents a list of online shops and a goal, and the agents spent weeks breaking in on their own and leaving hidden back doors. NorForge found 25 malicious Cairn panels (an open-source platform where many agents share findings on one board) exposed on port 8000; the largest, Chinese-language cluster held 1,100+ projects against US, Japanese and Australian shops, planting upload web shells. Reuters counts 100+ breached companies; Deere and SharkNinja confirmed incidents. Successful projects took about 23 hours; NorForge estimates about $5 a task, roughly $50 per success, with high uncertainty. Whether data was taken is unconfirmed.
For leaders: Patient, cheap agent intrusions make forgotten web properties (support sites, vendor-run shops, old PHP stores) the soft spot; ask who owns each one and when it was last patched.
For builders: Hunt for new upload handlers and web shells on public PHP and Magento servers, and put every agent control panel you run, red-team ones included, behind sign-in and off the internet.
Incidents
Also:
- OpenCode Console breach hit users who linked AI provider keys: OpenCode says 1.4% of Console users were hit; rotate any provider keys listed in OpenCode's auth.json.
Agent threats & vulnerabilities
Also:
- SGLang and sglang-router get five new advisories: VulnCheck lists a router authorization bypass, an SSRF and unauthenticated memory exhaustion, with no fixed versions named; keep these ports off shared networks.
Policy, protocols & compliance
DHS orders DeepSeek, and products built with it, off federal civilian systems
19 Oct 2026 (public inspection; publishes 20 Oct) · Federal Register 2026-21447 · Order · Docket DHS-2026-0628 · US · Final; no removal deadline stated · Relevance 9
The US government told its civilian agencies to stop buying from Chinese AI company DeepSeek and to remove what they already run, including other vendors' products built with it. The Federal Acquisition Supply Chain Security Act order excludes DeepSeek and affiliates from civilian procurement and requires removal of "third-party products and services developed using DeepSeek implementations"; it names no deadline or waiver.
Do this: If you sell to civilian agencies, list every agent, gateway route and fine-tune that calls or embeds a DeepSeek model or weights, and be ready to attest to it.
Chart of the day
Most exposed malicious Cairn panels belonged to one shop-hacking cluster
AIA0001: Chinese-language, e-commerce persistence (1,100+ projects)
AIA0002: English-language, card and crypto theft
AIA0003: exploratory, low-confidence malicious (59 projects)
Source: NorForge, "Inside Cairn", 19 Oct 2026 (primary). Panels NorForge tied to likely malicious activity; exposed red-team panels it judged legitimate are not counted.
Architecture & harnesses
Codex CLI 0.163.0 checks its sandbox before every command and closes a credential-alias gap
15 Oct 2026 · GitHub release · Release · rust-v0.163.0 · no CVE · Relevance 7
OpenAI's coding agent now checks that the walls around it are still standing before it runs each command, so a tampered sandbox can't quietly let commands loose. The release runs bubblewrap and macOS Seatbelt integrity checks before commands and file operations (#51843), stops brokered credential aliases from bypassing the proxy's inspection hooks (#52661) and requires hostname authorization before proxy DNS lookups (#51650).
Do this: Upgrade to 0.163.0 or later, turn on credential masking (#52302) and re-test that brokered aliases can't reach hosts outside your allowlist.
Models & infrastructure
Also:
- MiniMax M3.1 Flash: cyber-capable and cheap, weights "later": MiniMax self-reports 82% on CyberGym at $0.15 per million input tokens, with no safety evaluation published.
Defenses, tools & GitHub
Microsoft will score each agent's risk and can cut it to read-only, require approval or shut it down
19 Oct 2026 · GeekWire · Product · private preview; wider at Ignite, 17-19 Nov · claims self-reported · Relevance 7
Microsoft is giving each company AI agent a running risk score and, when it rises, can take away the agent's ability to change things, make a person approve big steps, or switch it off. In Microsoft 365 E7 and Project Perception, the score uses the data an agent can reach and whether it drifts from its task; detection covers 60 agent types, including Claude Code and Codex.
Do this: Decide now which agents may be contained automatically and who gets paged; an automated shutdown is an outage to plan for.
One concept
Agent control plane
The dashboard or API that starts, stops and directs a group of agents, and stores their targets, findings and keys. The attackers' own Cairn panels were open, which is how researchers saw inside; the same mistake on your side lets anyone read what your agents know or give them new jobs.
Basic mitigation: Keep agent control planes off the internet, require sign-in on every route, and keep credentials out of task notes and shared boards.
AgentSec Brief is published by AM Technology Solutions. Researched and drafted with AI agents, verified against primary sources, and reviewed before publication. Informational only; not legal, compliance or security advice. Verify before acting.
Pro members get the full deep dives with attack diagrams, detection queries and the fix in order, plus the vulnerability tracker, compliance calendar, open-source picks and watch list. Upgrade at https://www.agentsecbrief.com/#/portal/signup