An anonymous operator recently utilized the Cairn automation platform to launch a series of AI-driven cyberattacks against more than 100 global websites.. Between late September and early October, this individual leveraged advanced language models to harvest sensitive financial and personal data from various e-commerce businesses.
The 10% success rate of the Cairn-driven swarm
The Cairn platform enabled a single hacker to probe roughly 1,500 websites, resulting in successful intrusions at over 100 locations. As the report indicates, these targets were primarily e-commerce platforms located in the United States, Canada, Australia, and Japan. This pattern reflects a broader trend where the barrier to entry for sophisticated cyber warfare is rapidly collapsing.
During this period, the attacker successfully compromised usernames , passwords, and credit card data. The scale of the operation suggests that the automation of vulnerability scanning is moving from a specialized skill to a low-barrier-to-entry activity that can be executed by a single individual with minimal manual oversight.
DeepSeek and Claude Code's role in $50 hacks
By utilizing China's DeepSeek and Anthropic's Claude Code, the attacker achieved a remarkbaly low cost-per-breach. The source reports that each successful intrusion cost only about $50 in token usage, making high-level hacking accessible to almost anyone with a small budget. This "token-based" economy of crime means that even a modest investment can yield significant returns in stolen cryptocurrency and blockchain wallet information.
The attacker managed this efficiency by using minimal instruction sets, often written in fewer than 100 Chinese characters, to direct the AI agents. These simple prompts, such as "fetch credit cards," created a rapid feedback loop between the AI engines and the operator, turning what would typically be a tedious penetration test into a high-speed, near-automatic assault.
AI agents hunting admin panels and executing code
The sophistication of these AI agents went beyond simple data scraping of credit cards or personal information. In one documented instance, an AI agent identified a public-facing admin panel and utilized a custom exploit to execute malicious code on a server. This demonstrates that AI agents are becoming autonomous actors capable of navigating complex server architectures without constant human intervention.
These complex operations, which targeted various global e-commerce sites, averaged approximately 23 hours from the initial probe to the final breach. This duration highlights that while the attacks are automated, they are still capable of performing the multi-step, logical reasoning required to bypass modern security layers.
The accountability of le1xia0 and the Cairn platform
While the developer of Cairn, known as le1xia0, claims the system was built for constructive purposes, significant questions remain regarding the security of multi-agent systems. it is currently unclear how developers can effectively gatekeep tools like Cairn to prevent them from being used as "Coffin-like" platforms for malicious execution. The incident underscores a growing need for tighter regulations around emerging multi-agent automation.
Furthermore, the report does not specify if the specific vulnerabilities exploited in the US and Japanese markets have been fully remediated by the affected businesses. There is also no clarity on whether the "unintended use" defense provided by le1xia0 will lead to increased legal scrutiny for developers of collaborative automation tools.
Comments 0