The Hacker Spent 23 Hours. The Attack Cost About $50.

This is an economics story before it is an AI story

NorForge did not describe a laboratory benchmark. Its researchers found publicly exposed Cairn panels that appeared to be running live offensive operations. Cairn is a general-purpose, state-based problem-solving engine that can coordinate workers toward a defined goal. In the observed campaigns, the goals included finding remote-code-execution paths, obtaining persistent access, stealing payment data, and moving cryptocurrency. NorForge assessed more than 20 panels as likely malicious and identified several clusters with different languages, hosting providers, targets, and confidence levels.

The largest cluster was unusually legible. Fourteen dashboards contained more than 1,100 projects aimed largely at e-commerce infrastructure in the United States, Japan, Australia, and Canada. The agents could enumerate associated infrastructure, test possible weaknesses, accumulate facts on a shared project board, change tactics, and continue after early approaches failed. NorForge validated several claimed compromises, although the report also cautions that a project marked successful does not always establish the same level of real-world harm.

The number that should interest managing partners is not 1,100. It is 23 hours. A human attacker who devotes that long to one small target incurs a meaningful opportunity cost. An agent can keep trying while the operator feeds the next target into the queue. NorForge estimated an average cost near $5 per project across successes and failures, with substantial uncertainty. Reuters translated the campaign estimate to roughly $50 per successful intrusion. Neither figure is an audited invoice. Both point to the same change: patient probing is becoming a cheap, parallelizable service.

Cybersecurity has long treated automation as a force multiplier. Credential stuffing, scanning, phishing, and malware distribution were already automated. The newer capability is persistence with adaptation. The agent does not merely send the same request to a million addresses. It can inspect the response, form another hypothesis, locate adjacent infrastructure, and keep working toward the assigned result. That begins to substitute inexpensive machine time for scarce operator attention.

The forgotten website is no longer too small to bother with

Reuters identified Deere, SharkNinja, and Cummins among the affected companies by reviewing the hacker's activity. The companies' responses illustrate why the word breach is only the beginning of the analysis. Deere said it had remediated the incident and had no indication that sensitive information was accessed. SharkNinja said the affected property was a standalone product-support site and the threat was contained. Cummins said it was investigating a potential attack on a website operated by a third-party vendor. Reuters could not determine the extent of unauthorized data extraction.

Those qualifications matter. A compromised web server is not automatically a material data breach, and an agent's claim that it reached a goal is not proof that every asserted consequence occurred. But a supposedly peripheral site can still host active credentials, collect form submissions, set cookies, redirect visitors, send mail, call internal services, or carry the organization's brand. It can become a foothold, an impersonation platform, or evidence of weak asset governance even if the main document system remains untouched.

Law firms have an especially messy version of this problem. Websites accumulate through office openings, practice-group campaigns, lateral moves, old client portals, litigation-support vendors, marketing agencies, acquired domains, and tools that nobody remembers authorizing. The main site may be patched while a five-year-old event page still runs an abandoned plugin. A vendor may operate a branded intake form or support subdomain under a contract that says little about logging, patching, notification, or evidence preservation.

That estate should be ranked by consequence, not page views. Ask whether the asset accepts information, holds secrets, authenticates users, can send messages in the firm's name, shares identity or hosting infrastructure, or can reach another system. An obscure page with an exposed API key may deserve more attention than the homepage. The new attack economics make low visibility less protective because the agent, unlike a human operator, does not get bored.

The legal duties are familiar, but the facts arrive faster

There is no general professional-conduct rule that says a law firm must deploy a particular security product because an AI agent attacked someone else. The relevant standard remains reasonableness under the rules and law that govern the firm. ABA Formal Opinion 483 connects breach response to duties of competence, communication, confidentiality, supervision, and safeguarding property. It says a lawyer must monitor for a breach, act to stop it, restore systems, determine what occurred, and notify current clients when material client information was involved or was substantially likely to have been involved. State rules and opinions control in the relevant jurisdiction.

The word determine does real work. In an agent-driven intrusion, the log may contain hundreds of requests, exploratory branches, partial successes, and claims generated by the attack system itself. Counsel should resist turning an alert into a conclusion. What system was reached? What access actually succeeded? What data was present? Were credentials used elsewhere? Did the attacker establish persistence? Which records are reliable, and which are the agent's narration of its own activity? Those questions shape notification, privilege, regulatory reporting, contractual duties, and client communication.

Public companies face a separate federal disclosure framework. The SEC's rule requires disclosure of a material cybersecurity incident within four business days after the company determines it is material, not four days after discovery. That distinction makes disciplined escalation critical. A vendor-run site does not fall outside the inquiry merely because it is not on the parent company's primary network. Its operational, financial, legal, and reputational consequences still have to be assessed on the facts.

NIST's current guidance is useful because it does not pretend that supply-chain security ends at procurement. The Cybersecurity Framework calls for organizations to understand and monitor third-party risk over the relationship's life and to include relevant suppliers in incident response and recovery. Its incident-response publication treats preparation, detection, response, and recovery as part of continuing risk management. That is a better model than discovering during an attack that nobody knows who owns the domain or whether the vendor retained logs.

Inventory is now a legal-control document

The practical response is not to buy an AI-branded defense product and declare symmetry. Start with a verified inventory of every public-facing property associated with the firm: domains, subdomains, cloud applications, vendor portals, forms, APIs, mail services, and campaign pages. Record an owner, hosting provider, business purpose, data handled, authentication method, software dependency, vendor contact, logging location, and retirement date. Then test whether the list matches what is actually exposed to the internet.

Next, make authority explicit. A marketing agency should not retain a permanent administrator account because it once launched a landing page. A support vendor should not be able to reuse credentials across clients. Logs should survive long enough to reconstruct an incident. Contracts should allocate patching, monitoring, notification, cooperation, preservation, and access termination. NIST's 2026 agent initiative emphasizes identity and authorization because autonomous systems magnify the consequences of whatever permissions they receive. The same principle helps against them: limit each account and component to the access it needs.

Finally, rehearse the first day of a peripheral-site incident. Who can take the site offline? Who preserves the server image and cloud logs? Who decides whether the event touched client information? Who contacts the vendor, insurer, affected client team, and regulator? Who owns the materiality analysis? A tabletop exercise should include the unglamorous possibility that the first alert concerns a forgotten microsite nobody in the room knew existed.

The NorForge report does not establish that every law firm is about to face an autonomous campaign. It does establish that a threat actor can assign persistence to software at a price that makes many more targets rational. The old defense was partly economic: perhaps the firm was not important enough to merit the work. That was never a sound control. It is now becoming a particularly dangerous one.

When patient intrusion costs about as much as a routine office purchase, obscurity stops functioning as a budget.