On October 19, Reuters reported that a hacker used commercially available AI agents to compromise websites associated with more than 100 companies, according to coverage by Tom's Hardware and others. The activity was reportedly discovered by a security researcher who found the attacker's infrastructure exposed online, and estimated the AI costs of the whole campaign at around $5,000, or about $50 per successful break-in. Many details, including exactly which tools were used and how much data was taken, remain unconfirmed.
Why This Matters for Smaller Businesses
Attacks used to be limited by how much time skilled people could spend. AI agents remove much of that limit: they can scan, probe and retry across hundreds of sites without getting tired. That shifts attention to targets that were once ignored, including small online stores and company websites running out-of-date software.
What Attackers Usually Exploit
The basics still do most of the damage: unpatched plugins and content management systems, default or reused passwords, forgotten admin pages, exposed configuration files and test sites left online.
What to Do This Week
- Update your website platform, themes and plugins, and remove the ones you no longer use.
- Turn on multi-factor authentication for every admin account, hosting panel and domain registrar.
- Look for forgotten copies of your site, such as staging, test or old versions, and take them down.
- Make sure configuration files and backups cannot be downloaded from the web.
- Put a web application firewall in front of your site if your host offers one.
- Set up alerts for new admin accounts, file changes and unusual login attempts.
- Keep recent backups stored somewhere separate from the website.
The Takeaway
AI makes attacks cheaper, not smarter. The same well-known gaps are being found faster, which makes keeping up with the basics more important than ever.