How One Hacker Turned AI Into a Hacking Army

One hacker. AI agents. More than 1,200 websites targeted. What does the reported $50-per-success AI cost estimate really mean? This episode unpacks the Cairn case reported by Reuters and NorForge on October 19, 2026: the agent loop, shared blackboard, persistent search, and the exposed dashboard that revealed the operation. More than 100 companies' websites were reportedly compromised. That does not establish that every core system was reached or that data was stolen. NorForge researcher Snorre Fagerland's roughly $50 estimate concerns AI token spend per reported successful intrusion, not its full cost or a guaranteed price. Deere reported remediation and no indication of sensitive information access. SharkNinja described a contained incident on a standalone product-support site. Cummins was investigating a possible attack on a third-party vendor's site. How can agentic AI keep searching after the first prompt? We explain how tools, feedback and shared records extend an agent's activity, and why access controls must enforce the boundaries around it. Subscribe to Hidden Mechanics Studio for visual explanations of the systems behind the headline. CHAPTERS 00:00 One hacker, AI agents, and a $50 estimate 00:47 What Reuters and NorForge confirmed 01:54 How the AI agent loop works 03:13 Facts, intents, and adaptive search 04:40 The shared blackboard 06:07 Why access is more than a front door 07:32 What the $50 estimate actually means 09:10 What the dashboard cannot prove 10:41 The attackers' exposed dashboard 12:05 Tools, permissions, and access controls 13:46 The mechanism and the boundaries SOURCES NorForge investigation https://norforge.com/blog/inside_cairn Reuters reporting, republished by Investing.com https://www.investing.com/news/stock-... Cairn architecture https://github.com/oritera/Cairn CISA: internet-exposed management interfaces https://www.cisa.gov/news-events/aler... OWASP: excessive agency https://genai.owasp.org/llmrisk/llm06... PHOTO CREDITS John Deere tracked tractor: Wikideas1, CC0 1.0. https://commons.wikimedia.org/wiki/Fi... https://creativecommons.org/publicdom... Blender (Ninja): Ajay Suresh, CC BY 2.0. https://commons.wikimedia.org/wiki/Fi... https://creativecommons.org/licenses/... Cummins ISX 600 engine: Panoha, CC BY-SA 3.0. https://commons.wikimedia.org/wiki/Fi... https://creativecommons.org/licenses/... Photo presentation: inset framing and small animated scale changes; separate brand marks and captions. Original image files are preserved. Product photos identify manufacturers and are not incident footage or evidence of compromised devices. VISUALS AND AUDIO Photorealistic editorial illustrations are AI-generated and labeled ILLUSTRATION. Diagrams are explanatory. Narration uses creator-supplied AI voice recordings. The video explains the mechanism at a general level and contains no step-by-step intrusion instructions. #AIAgents #Cybersecurity #AgenticAI