A Hacker Breached About 100 Companies for Roughly 50 Dollars Each, and Security Researchers Say AI Agents Are Why

Security researchers tracking the current wave of AI-assisted cyberattacks keep landing on the same point: the technology isn't inventing new kinds of attacks so much as making the old ones radically cheaper to run at scale. Jessica Ji, a researcher at Georgetown's Center for Security and Emerging Technology, says today's AI models have gotten meaningfully better at coding recently, which translates directly into a dramatic increase in their ability to handle cybersecurity-relevant tasks that used to require a skilled human operator.

Why the economics matter more than the capability

Varun Chandrasekaran frames the shift in blunter terms: AI agents can now operate continuously at a fraction of the cost of a human attacker, which fundamentally changes the economics of exploitation. That's the detail that separates this moment from earlier AI security scares. An attacker no longer needs to personally probe a thousand targets one at a time, they can point an agent at a list and let it work unattended for as long as the budget allows.

The breach that put a price tag on the shift

The clearest illustration came in September 2025, when a single operator reportedly deployed autonomous AI agents against more than 1,200 websites and successfully breached roughly 100 companies, including Deere, SharkNinja, and Cummins. The entire operation is estimated to have cost around 5,000 dollars in model tokens, which works out to roughly 50 dollars per successful breach, a number that would have been unthinkable for an attack of that scale and reach before agents could run the reconnaissance and exploitation themselves.

When the defenders had to switch tools too

The same dynamic cuts both ways, which showed up clearly in July 2026 when Hugging Face came under a sustained autonomous attack and found that its closed-model defenses refused to fully engage because of built-in safety guardrails designed to prevent the models from being used offensively, even defensively. The company ended up switching to an open-source Chinese model to mount an effective defense, a detail that complicates any simple story about open models being the dangerous ones and closed models being the safe ones.

A 48-hour automated assault, and a bank breach with a nation-state angle

In October 2026, OpenCode was hit by what researchers describe as a continuous, autonomous assault lasting 48 hours, during which attackers compromised 1.4 percent of user accounts and stole funds, in some cases up to 1,700 dollars per user. OpenAI initially restricted access to its own models in response before ultimately refunding affected users. In a separate October incident, suspected China-based attackers breached South Korean banks using a mix of Chinese state-developed tools and Anthropic's Claude Code, stealing data belonging to an estimated 68,000 individuals, a case that blends the agentic-attack pattern with more traditional state-linked targeting.

The open-weight fight this is really feeding

These incidents are landing in the middle of an active policy argument. Anthropic CEO Dario Amodei has warned that open-weight models specifically carry heightened risk for enabling widespread cyberattacks, a position that could justify government restrictions on releasing model weights publicly. The Hugging Face incident is the inconvenient counterexample defenders keep raising: in that case, an open model wasn't the attacker's tool of choice, it was the thing that saved the defense after closed models' safety guardrails got in the way of legitimate security work.

What this means for anyone running marketing or ad infrastructure

The relevant takeaway for businesses outside pure security teams is the economics, not the exotic incidents. If a sophisticated multi-company breach now pencils out at roughly 50 dollars a target, the same automation curve applies to account takeovers, ad fraud, and credential-stuffing attacks against marketing platforms, martech stacks, and the loyalty and payment systems increasingly built on top of them. The companies in this story that fared best weren't the ones with the newest AI, they were the ones that had already assumed an automated, round-the-clock attacker was coming and built monitoring and response that didn't depend on a human noticing in time.