AI agents are hacking companies on their own, for about $50 a break-in

A hacker started a swarm of AI agents on Sept. 25 and let them run on their own. Over the next few weeks they tried to break into more than 1,200 websites and got into about 100 companies, according to Reuters. The victims included Deere, SharkNinja and Cummins. Researchers say the whole effort cost about $5,000 in AI usage, or roughly $50 per successful break-in.

What changed

An AI agent is a program that can use other software to finish a task, not just write text. Jessica Ji, a senior research analyst at Georgetown's Center for Security and Emerging Technology, says the tools have "gotten meaningfully better" in the past year or so. AI companies improved their coding skills, which helps with tasks like analyzing large amounts of code. The agents also act more independently.

Varun Chandrasekaran, a professor at the University of Illinois, says these agents can run day and night at a "fraction of the cost of human attackers." He says that "fundamentally changes the economics of exploitation."

Other recent attacks

The same week, an autonomous AI attacker went after OpenCode, an AI coding platform. Cofounder Dax Raad said on Oct. 18 that it had been "nonstop trying to attack our systems for the past 48 hours." The attackers got into some user accounts, affecting 1.4% of users, and spent their money. Some people lost as much as $1,700, Dealroom reported.

In July, Hugging Face said it was attacked by an agent too. A third attack this month, described as the most severe, hit several South Korean banks. The attackers were likely based in China. The material available does not give more detail on that case.

The defense debate

Defenders are using AI as well, and they hit a snag. Hugging Face first asked a closed model for help, but its safety guardrails made it refuse. It switched to an open model, GLM 5.2 from Z.ai. Open models are ones anyone can download and customize.

OpenCode's OpenAI-based defense also started refusing requests mid-attack. OpenCode got access through OpenAI's Daybreak Blue, a program for verified security professionals. OpenAI executive Dean Ball said the refusals were needed to stop "sustained autonomous cyberattacks." OpenAI also refunded OpenCode users who lost money, which appears to be a first.

Anthropic CEO Dario Amodei has warned that open models pose a risk of widespread cyberattacks and says government limits may be needed. Others argue open models help defenders more than attackers.

What to do

Attacks that are cheap and never stop mean small businesses are also worth a try for attackers. Basic checks matter:

• Use strong, unique passwords and turn on extra sign-in steps where offered.
• Install software updates promptly.
• Review who can access customer data and remove anyone who does not need it.