Summary
- Researchers investigated a campaign in which an attacker used AI agents to compromise websites across several countries.
- The reported activity involved autonomous reconnaissance and intrusion tasks with limited human instructions.
- The findings concern a documented international campaign; UK or European victims have not been independently established.
A cybercrime investigation has documented how an attacker used artificial intelligence agents to conduct intrusions against more than 100 websites, illustrating how autonomous tools may reduce the time and human effort required to mount repeated attacks.
The findings, reported on 19 October, concern a campaign investigated by cybersecurity researcher Snorre Fagerland involving websites operated by organisations in the United States, Canada, Australia, and Japan.
The attacker reportedly used an AI platform called Cairn and issued relatively short instructions while allowing agents to carry out substantial portions of the technical work.
Reuters reported that the campaign began on 25 September and involved a Chinese-speaking criminal whose tools were used to identify weaknesses, probe systems, and pursue unauthorised access.
The research does not establish that UK or European organisations were victims of this particular campaign. Its significance for those markets lies in the demonstrated use of broadly available AI capabilities against internet-facing business systems.
From instructions to sustained intrusion activity
Conventional cyber intrusions may involve multiple stages of reconnaissance, vulnerability identification, exploitation, and further investigation of compromised systems.
Some of those tasks already lend themselves to automation. Scanning for exposed software versions, enumerating applications, and checking for known weaknesses can be performed using established security tools.
AI agents potentially change the process by selecting and adapting sequences of actions based on information encountered during the activity.
Rather than following a fixed script, an agent can be given a broad objective and access to tools that allow it to inspect results, adjust its approach, and continue working.
According to the investigation, the attacker used short prompts to direct the agents, while the tools performed extended sequences of activity against target sites.
Reuters reported an average of around 23 hours of AI work for a successful intrusion and estimated the associated AI expenditure at approximately $50 per successful compromise.
The reported total expenditure was about $5,000 across the campaign.
Those estimates describe the resources identified in this investigation. They do not establish a general market price for compromising a website or prove that similar attempts will succeed against other organisations.
Some affected companies acknowledged security incidents, while the information available did not establish extensive sensitive-data loss across the entire campaign.
Autonomy changes the economics of attack
The campaign illustrates a distinction between using AI to assist a human attacker and giving an automated system greater responsibility for carrying out a sequence of technical operations.
AI-assisted coding, vulnerability research, and reconnaissance can increase an individual’s productivity without changing who directs each action.
Agentic workflows may permit an attacker to supervise several targets while automated processes continue exploring particular systems with relatively little intervention.
That does not remove the requirement for usable vulnerabilities, reachable targets, and successful exploitation. Autonomous tools remain constrained by the systems and permissions available to them, and their output can be inaccurate.
However, the ability to attempt more actions with less direct human effort could change how quickly poorly maintained internet-facing systems attract attention.
Attackers may also reuse successful procedures across targets or redirect agents towards new opportunities identified during an earlier attempt.
The consequences for defenders depend on whether their systems expose vulnerabilities that these tools can exploit and whether monitoring can distinguish suspicious automated behaviour from legitimate use.
Implications for European enterprises
European organisations are already subject to different combinations of cybersecurity, privacy, and operational resilience obligations depending on their sector and location.
Frameworks such as the EU’s NIS2 Directive and the Digital Operational Resilience Act place emphasis on risk management, incident handling, and the security of supporting services.
The appearance of more capable automated intrusion tooling does not change the legal scope of those frameworks. It may, however, influence the assumptions used in exposure assessments and incident response planning.
Systems that remain vulnerable for long periods may face a higher volume of automated probing, while unusual sequences of application requests could become harder to attribute to a single human operator.
There is also a separate governance question for organisations conducting their own AI-assisted security testing. Permission boundaries and control over the tools used by autonomous agents must remain explicit.
An agent authorised to examine one application should not be assumed to possess permission to pursue vulnerabilities in every connected service it discovers.
Recent public disclosures involving unexpected agent behaviour during security research have increased scrutiny of those boundaries, although they should not be conflated with this deliberately criminal campaign.
Fagerland’s investigation provides a documented example of one attacker using AI agents at scale. It does not establish that autonomous intrusions have replaced other methods or that every target suffered the same consequences.
The outstanding questions concern how reliably such tooling can reproduce its results, whether attackers can scale similar campaigns further, and how organisations will detect activity that increasingly combines familiar exploitation techniques with automated decision-making.
