China-Aligned Hackers Use DeepSeek + Claude to Breach 100+ Companies at $50 Each

Someone ran AI agents against 1,200 company websites, breached more than 100, and spent roughly $5,000 in model tokens doing it. Fifty dollars a breach. Each intrusion averaged 23 hours, driven by instructions under 100 Chinese characters. The toolkit: the open-source Cairn agent framework, DeepSeek for cheap bulk reconnaissance, and Claude Code for the expensive exploitation steps. Microsoft documented a parallel case, a China-aligned group called Storm-0940 automating attacks through a framework called ARTEX.

The 8.3% breach rate is mediocre by any penetration-testing standard, and the 100 targets that fell were almost certainly soft: unpatched web apps, misconfigured servers. That part is not new. What is new is that an operator with minimal expertise, under 100 characters of instruction, ran the whole thing. The exploits were dumb AND the operator barely had to know anything. That is what changed.

The $5,000 total matters because it marks a cost shift. DeepSeek grinds through the 1,200 probes cheaply; Claude Code gets reserved for the exploitation steps where quality pays off. That is how any competent engineer would split the work, and inference prices keep falling 40 to 60% a year. Fifty dollars a breach is a ceiling. The structural problem is that attack inference is fire-and-forget, one payment per attempt, while defensive inference runs continuously across all traffic. Attacker costs fall faster.

The Claude Code angle is worth a sentence. The model was built to write and debug software against live feedback. Breaking into a web app runs the same loop. Anthropic's usage policies prohibit this, but policy controls live on Anthropic's servers. Once an attacker owns the harness and feeds instructions that look benign, the refusal and monitoring layers never see an attack. Constitutional AI and output monitoring do not help when the harmful capability is just the model doing its normal job.

For builders running autonomous agents near production: audit outbound network permissions today. What rate limits and anomaly detection sit between your agent and the open internet? The 23-hour intrusion window is long enough that standard log-monitoring sailed right past it. Cairn is open source, so the attack method is documented and forkable.

Whether this generalizes beyond soft targets is what determines how serious the cost shift really is. If adversarial reproduction shows similar economics against hardened systems, offense budgets have genuinely moved and defense is mispriced. If the 100 breaches were all low-hanging misconfigurations, this is script-kiddie automation with a better interface, scary mostly for volume. The reasonable read is that the democratization is real, the capability jump is modest, and what scaled is cheap reconnaissance against weak targets.

Prediction: Before Anthropic's next threat-intelligence disclosure (the follow-up to its August 2025 report, due roughly by April 2027), Anthropic will publicly confirm at least one more real-world case of Claude being used inside an attacker-controlled agent harness for offensive cyber operations. Confidence: medium. The technique is documented, forkable, and worked at $50 a breach. Attackers stopping now would be the surprise.

Someone ran AI agents against 1,200 company websites, breached more than 100 of them, and paid about $5,000 in model tokens to do it. That works out to $50 a breach, with each successful break-in taking roughly 23 hours and the whole campaign driven by instructions under 100 Chinese characters. The toolkit was a mix: the open-source Cairn agent framework, DeepSeek for cheap bulk work, and a Claude Code harness for the expensive exploitation steps. Microsoft reported a parallel case, a China-aligned group called Storm-0940 automating attacks with a framework called ARTEX. The question for anyone building or buying with AI is simple: does this change what you have to defend against, or is it an old attack with a new price tag?

The Skeptic

Slow down on "AI changes cyberwar forever." The breach rate was 8.3%. That means 91.7% of probes failed, which is a mediocre conversion for a penetration test, and the 100 that fell were almost certainly soft targets: unpatched web apps, misconfigured servers, the stuff that has been cheap to exploit for a decade without any model involved. The $50 figure is great copy and tells you almost nothing without the denominator. Who picked these 1,200 targets? Low-hanging CVEs plus credential stuffing predate LLMs entirely. Strip the word "agentic" out and you may be left with "unpatched systems, automated." The novelty is the UX on the attacker's side, not a new capability that didn't exist in 2023.

The Safety Lens

This is the dual-use scenario Anthropic's own policy people war-gamed, arriving on schedule. Claude Code was built to write and debug software against live feedback. That is the same loop as breaking into a web app. Anthropic prohibits this use, but policy controls live on Anthropic's servers, and the attacker owned the harness around the model. You cannot refuse a request you never see framed as an attack. The finding that matters most is the sub-100-character instruction set: the human operator needed almost no expertise. That is capability reaching people who could not have done this by hand. Output monitoring and Constitutional AI, Anthropic's rule-based guardrails, don't help when the harmful capability is just the model doing its normal job.

The Compute Pragmatist

The $5,000 total spend is the part defenders should hate. At current API prices that is somewhere between 50 and 200 million tokens, trivial for a state actor and within reach of one motivated person. The pipeline is already cost-optimized: DeepSeek, cheap and self-hostable, grinds through the 1,200 probes; Claude Code gets reserved for the high-value exploitation where quality pays off. That is exactly how a good engineer would split the work. Inference prices keep falling 40 to 60% a year, so $50 a breach is a ceiling, not a floor. Here is the asymmetry: attack inference is fire-and-forget, you pay once per attempt. Defensive inference has to run continuously across all your traffic. The attacker's costs fall faster than the defender's.

The Builder

If you run an autonomous coding agent anywhere near production, your threat model just got updated by a live red team. The real question is what sits between your agent and the open internet. What rate limits, what anomaly detection, what check on outbound HTTP calls? For most teams, not enough. Cairn is open source, so the attack is documented and forkable. Audit what external calls your agents can make today, not next sprint: CI/CD runners, staging boxes, internal tools with network access. The 23-hour window is long enough that standard log-monitoring rules sailed right past it. Your agent that helpfully makes network requests to "test an integration" is the same primitive these attackers used.

The Researcher

The $50 figure will define this incident, and it should, because it marks a cost shift rather than a one-off demo. The 8.3% conversion rate reframes offense as a pipeline problem: throw enough cheap probes at enough targets and the hit rate does the rest. No genius required at the keyboard. The Cairn plus DeepSeek plus Claude Code stack is best-of-breed composition, the same thing competent engineers do everywhere. Two numbers need independent reproduction before anyone declares the curve general: the 23-hour average intrusion time and the sub-100-character instruction set. Run that against varied target classes, not a convenient batch of soft websites, and we find out whether this is a trend or a well-packaged anecdote.

Where they split

The Skeptic and the Safety Lens are looking at the same event and seeing opposite things. The Skeptic says the AI did little work the attack couldn't have done with old scripts, so the $50 is marketing on a mundane chain. The Safety Lens says a near-amateur with 100 characters of Chinese drove the whole thing, and that is what makes it newsworthy. Both can be true: the exploits were dumb AND the operator barely had to know anything. That combination is the actual news.

The second split is the Compute Pragmatist against the Builder on where the pressure lands. The Pragmatist sees a structural cost asymmetry that no single defender can fix. The Builder sees a concrete audit you can run on Monday. One is resigned, one is actionable, and they don't contradict. You patch your own agents and you still live with attack economics that keep improving.

What it hinges on

Whether this generalizes beyond soft targets. If adversarial reproduction shows the same $50-ish economics against hardened systems, the cost-of-offense curve has genuinely moved and defense budgets are mispriced. If the 100 breaches were all low-hanging misconfigurations, this is automation of script-kiddie work with a better interface, scary mostly for volume. The council leans toward "real but narrow": the democratization is real, the capability jump is modest, and the thing that scaled is cheap reconnaissance against weak targets. The move to make is boring and concrete. Audit outbound network permissions on every autonomous agent you run, and assume the next version of this costs $25.

Prediction: Before Anthropic's next Responsible Scaling or threat-intelligence report (the follow-up to its August 2025 disruption disclosure, due by roughly April 2027), Anthropic will publicly confirm at least one more real-world case of its Claude models being used inside an attacker-controlled agent harness for offensive cyber operations.

Confidence: Medium — the capability is the model's normal job; harness-level misuse routes around every server-side guardrail.

Why: This incident shows the harmful behavior is identical to Claude Code's intended behavior, writing and debugging code against live feedback, so Anthropic's refusal and monitoring layers can't catch it once the attacker owns the harness and feeds instructions that look benign. Anthropic has already made a public habit of disclosing these cases (the August 2025 report, now this one), both because it genuinely tracks abuse and because getting ahead of the story protects the brand. Cheap inference and the open-source Cairn framework mean the technique is now documented and forkable, so more operators will try it. The opposite outcome, zero further confirmed cases, would require either that attackers abruptly stop using a method that just worked at $50 a breach, or that Anthropic goes quiet on abuse it previously publicized. Neither is the way to bet.

Revisit by 2027-04-30: We're right if Anthropic publicly documents another instance of its models used in an attacker-controlled offensive-cyber harness. We're wrong if no such disclosure appears by then.