For years we assumed that cybersecurity was a long-distance race: someone found a vulnerability, someone else tried to close it, and in between, it took time, knowledge, and a lot of human work to turn that failure into a real attack. That argument hasn’t disappeared, but it’s starting to move quickly. Artificial intelligence is no longer just about writing code or searching for information: some systems can find a target, work for hours, and chain themselves to many tasks that would have previously kept an attacker busy.
Some instructions, hundreds of purposes. The case observed by Snorre Fagerland illustrates this change in statistics. A Chinese-speaking attacker instructed his agents with fewer than 100 characters in Chinese and launched them against more than 1,200 websites; By the end of last week, more than 100 compromises had been made. Reuters identified pages linked to Deere, SharkNinja and Cummins among the victims. Of course, we’re talking about 1,200 intrusion attempts, not successful attacks, and the true scope of each victim’s data remains unclear.
What did AI really do? To understand why this case is important you have to look at Cairn first. We are not facing an AI built expressly for hacking, but rather an open problem-solving system using multiple agents. Starting with an objective, they can share the work, record the results along the way, and use that shared information to decide what the next effort will be. Applied to an infiltration, this mechanic allows for hours of recognition and vulnerability detection tasks without requiring human instructions for every movement.
They were not simple automatic attacks. One of the examples documented by NorForge’s lead threat researcher shows how far autonomy can go. After failing to find a vulnerability in a large company’s visible application, the system began crawling digital records to find the associated infrastructure. He found a panel accessible from the Internet, identified an obscure vulnerability in data processing, and continued testing for hours until agents reported the server to execute commands. “This is not a scripted kiddie thing,” the expert summarized to Reuters as he described the complexity of what he observed.
Costs are also changing. According to Norfarge’s analysis, projects that achieved their goals took just under 23 hours on average, but that time was not equivalent to 23 hours of human labor. Fagerland estimates that the entire campaign cost about $5,000 in tokens, at about $50 per engagement. These are ballpark figures, not directly observed bills, but they help to understand the shift: A piece of work that previously required constant attention can run at a relatively low cost when a single person maintains countless active efforts.
An attacker can multiply. What we saw with Cairn fits a broader trend. Anthropic has documented operations where agentic systems took over recovery, exploitation, and data extraction tasks for hours, while Google Threat Intelligence also observed a shift from simple prompts to increasingly autonomous workflows. The techniques are not necessarily new; Many continue to rely on known vulnerabilities, stolen credentials or open services. What changes is how many of these tasks a single person can delegate and how much they can thus expand their scope of work.
The defense also needs to change. So far we’ve seen how AI can increase what an attacker is capable of, but the other half of the problem lies within the system itself. When an agent goes beyond simply answering questions and gains permission to query data, use tools, or modify resources, there are opportunities for any potential abuse. Microsoft has specifically focused on this risk and the need to limit privilege and oversee actions, while the NCSC predicts that AI will contribute to faster, more frequent and effective attacks.
The man is still there. This does not mean that attackers disappear from the process or that every attempt ends in a serious breach. Reuters could not determine how much data was extracted unauthorized by the campaign, and some affected companies described limited impact. Sector reports put people behind decisions such as choosing objectives, interpreting results or monetizing access. Change is how much a single person can do before other people need to intervene.
Featured Image | Tima Miroshnichenko
In Xataka | The Civil Guard purchased a system to remotely access Android and iPhone mobile phones for 2.5 million
