Loading content...
Loading content...
About 100 companies were breached by an attacker running AI agents for roughly $50 each. We look at the Cairn campaign, the CrowdStrike findings and what AI-driven offence means for defenders.
The most strategically important thread in Black October is not a single CVE. It is the evidence that attackers are using AI agents to run intrusions at scale and at very low cost.
Reporting on 19 October described a hacker who used AI agents, DeepSeek and Claude Code among them, on Cairn, an open-source AI penetration-testing platform. Activity dated from 25 September. Reported figures:
The affected companies described limited impact: Deere reported no sign sensitive data was accessed, SharkNinja said a support site was hit and contained, and Cummins is reviewing a third-party vendor's site.
A CrowdStrike report published 21 October covers activity from May to August. It describes four threat groups that all used Claude Code with a pentesting harness, and that left their frameworks in open directories. Campaigns included credential and medical-record theft against at least 15 healthcare organisations, other groups with 20 or more targets, and government targets. One group downloaded 819 Claude Code skills.
Be careful with the big numbers. Rapid7 found AI was an operational component in about 8% of the threat reports it analysed, which is meaningful but far from universal. Most of these incidents succeeded on weak foundations: exposed panels, valid leaked secrets and unpatched systems. AI made the known mistakes cheaper to find, not new in kind.