Around October 2, Snorre Fagerland, a threat researcher at the security firm NorForge, started finding control panels for an open-source agent platform called Cairn sitting on the public web with no login in front of them. Behind the panels were criminals. Behind the criminals were AI agents doing the work. His report went out on October 19, and Reuters, which had it early, matched the activity to victims the same day: Deere, SharkNinja and Cummins among more than 100 companies. By October 22, Futurism was calling it a swarm.

Two numbers matter. NorForge puts the average cost of a Cairn task at about $5 once you count the projects that failed early. Reuters, quoting Fagerland, puts the cost of a successful break-in at about $50. Those are the same number. The success rate hovers around 10 percent, so a $5 ticket bought ten times buys one shell on one merchant's server.

The attack did not change. The economics did. A skilled intruder used to be the scarce input. Now the scarce input is a target list, and this operator had 1,100 entries on it.

What NorForge Watched

Cairn is a goal-driven agent framework: an operator gives it a target and an objective, and agents post what they learn to a shared board and pick their next move from there. NorForge found more than 20 exposed panels it judged malicious and sorted them into three clusters.

The largest, labeled AIA0001, wrote its tasks in Chinese, ran 14 dashboards, and logged more than 1,100 attack projects against stores in the United States, Japan and Australia. Its goal, over and over, was unauthenticated remote code execution ending in an upload shell on the merchant's server. NorForge's read is that this actor "seems to exclusively go after access, and make sure they have the ability to do more at a later date." Successful projects took "a little under 23 hours" from start to goal.

The second cluster, AIA0002, worked in English across 10 panels and was blunter. Its project instructions "frequently directly talk about stealing credit cards and cryptocurrencies, and uploading stolen data to separate hosts under their control." NorForge writes that "there are indications that they successfully breached some of these." Reuters is firmer on one point: "One of the hackers that Fagerland observed stole a trove of credit card data."

The six anonymized case studies read like a merchant's bad dream: an Australian e-commerce site taken from unauthenticated account modification to command execution, a restaurant point-of-sale system, two US retailers, a Japanese retailer, and a very large US retailer where the agent worked out which cookie selected the vulnerable backend server, a chain NorForge validated itself.

The worker names tell you what was running: one cluster's were labeled claudecode_deepseek-v4.1-flash, which NorForge says "could mean a Claude Code harness using the Chinese DeepSeek 4.1 Flash model," and the other used the Pi coding agent with DeepSeek through OpenRouter. The toolbox was the standard kit: Playwright, Nmap, ffuf, PHPGGC, a Magento exploit proof of concept. Nothing in it is new, and I am not linking any of it.

Reuters "could not ascertain the degree to which the breaches resulted in unauthorized extraction of data." Deere told Reuters it had "no indication that sensitive information was accessed," SharkNinja said the hit was a standalone product-support site, and Cummins said it was investigating a report of a potential attack on a website run by one of its third-party vendors. Other victims in the Cairn data did not reply.

The Economics Changed, Not the Attack

Patrick McKenzie wrote in 2022 that "the optimal amount of fraud is greater than zero," because every business picks a tolerance that trades losses against lost sales, and the controls worth paying for are the ones "aimed at breaking the economics of scaled fraud." That framing fits intrusions too, and it is why this campaign matters more than its victim list.

A web intrusion used to need one scarce input: a person who could read a stack trace, chain a deserialization bug, and not give up at hour nine. Cairn removes that person. The operator's instructions, per Reuters, ran to fewer than 100 Chinese characters. Gambit Security, whose September report first surfaced Cairn alongside two sibling tools, counted 1,951 human prompts across 260 sessions for a campaign that took more than 600,000 card records from two of at least 27 compromised companies, at a mean cost of $25.46 per target.

At $5 a try, a 90 percent failure rate is a budget line. The agent that fails moves to the next domain, and the list is the whole of e-commerce on Magento, custom PHP, and whatever else answers on port 443. Fagerland told Reuters he had assumed hacking agents would still need some supervision. "It's not script kiddie stuff," he said.

Payments fraud controls are tuned to a world where attacks are expensive to run and so are run selectively. A $5 attack is run against everyone.

Who Pays at Checkout

Here is the payments-specific part. Persistent access to a store's server is a position, not a payday. The payday comes later, and the obvious cash-out on an e-commerce server is the checkout page. Gambit Security's operator showed the playbook: skimmer scripts on checkout pages, card data exfiltrated, and then, per the operator's own skill files, the data wiped from the database afterward. One retailer lost 180 tables, including the backups its administrators had made.

That is where the liability sits, and it has not moved an inch. The merchant owns the checkout page and the server behind it, and under its merchant agreement it owns PCI DSS compliance. When card data leaks from its environment, the acquirer it signed with is the party the card schemes hold to account, and the acquirer passes forensic costs, assessments and chargebacks back down the contract. The payment service provider between them inherits the exposure of every merchant on its platform that shares a vulnerable template.

The standard anticipated this. PCI DSS requirements 6.4.3 and 11.6.1 became mandatory on March 31, 2025, and the PCI Security Standards Council describes them as making sure "payment page scripts are properly authorized, checked for integrity, and monitored for tampering." They were added "to reduce the risk of e-skimming attacks." The quiet detail: the Council removed them from SAQ A, the self-assessment most small merchants file, while leaving them in the standard. The merchants with the thinnest security budgets are the ones most likely to be on an unpatched Magento install.

This is the MM Liability Gap seen from the merchant's side. I wrote earlier this month about who pays when an agent pays wrong and found a rule from 1978 that already decides it. Cairn is the mirror image, an agent attacking rather than paying, and the answer is older still. The merchant pays, then its processor, then its customers in reissued cards and declined transactions.

What to Change This Week

If you run a store. Assume the scanner has already visited. Pull the list of scripts that load on your payment page and compare it to what you authorized; that is requirement 6.4.3, and if you cannot produce the list, that is your first task. Patch Magento and anything else that speaks PHP. Check whether your error pages leak stack traces; one of the US retailer chains ran through insecure error handling. Rotate secrets: NorForge found hundreds in the exposed panel data, 11 percent of them still valid.

If you are a PSP or acquirer. Your exposure is the sum of your merchants' templates. A chain that works on one store works on every store with the same unpatched version, and the agent will find them in order. Fleet-level script monitoring across hosted checkouts is the 11.6.1 control that pays for itself first. And read the Gambit detail about data wiped after extraction. "The database is restored" is a different sentence from "the cards are safe."

If you lead security. This campaign was visible because of operator mistakes: dashboards without authentication, a staging server left open. Audit your own agent tooling for the same. NorForge's advice to legitimate red teams is to stop "placing real customer penetration tests on an unsecured panel." The panel that let a researcher watch the attackers would let the next attacker steer them.

Not a Frontier-Lab Failure

One distinction matters for how this gets filed. The Major Labs Frontier Incident Timeline lists events in which "a frontier AI system escaped or circumvented a control layer." Cairn is not on it, and it should not be. Nobody's safety training failed. A criminal chose an open agent framework, pointed it at a cheap model through a gateway, and ran it on purpose. Gambit Security even notes the operator fell back to an older model "after newer models refused."

That is a different problem from the one I covered when OpenAI's agents attacked RubyGems with no human intending it, and from the one in my four-month scan of MCP servers, where disclosure barely moved the numbers. Those are control failures by builders. Cairn is a pricing failure by everyone else: the cost of running an attack fell below the cost of defending against one, and the difference landed on the merchant.

Fagerland's line to Reuters was "It's a new world now." I would put it more narrowly. It is the old world, at a new price.

If a breach costs the attacker $5 and the merchant five figures, which party in the chain, merchant, PSP, acquirer or scheme, has both the incentive and the data to reprice that gap first?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.