AI Agents Are Making Website Break-Ins Cheaper. Security Basics to Check Now

What changed

On October 19, 2026, Reuters reported that a single hacker used autonomous AI agents to break into more than 100 companies' websites, out of over 1,200 that were targeted across the United States, Canada, Australia, and Japan. The researcher who found the activity, Snorre Fagerland of the firm NorForge, estimated the whole campaign cost roughly 5,000 dollars in AI usage, which works out to about 50 dollars per successful break-in. The agents ran on an open-source tool and, on average, took about 23 hours of mostly unattended work to get into a site. Reuters named some affected companies, including Deere, SharkNinja, and Cummins, which said they had investigated or contained the issue. Reuters said it could not establish how much data, if any, was actually taken.

The honest nuance

A few things are worth keeping straight. The report describes one operation found by one researcher, and some details, including which AI tools were used, are the researcher's analysis rather than confirmed fact. The news is not that AI invented a new way to hack. It is that AI makes old, well-known attacks cheaper and faster to run at scale, so more sites get probed than before. That cuts both ways for a small business. You are less likely to be singled out, but more likely to be swept up in a wide, automated sweep that does not care how small you are. The reassuring part is that attacks like these mostly find sites that were already behind on basic maintenance, which is something you can control.

Why it matters for your business

If you run a website, especially one built on common software like WordPress or a standard store platform, you are in the pool these automated sweeps run against. The cost of attacking you has dropped, which means the attempts go up even if nothing about your business changed. You do not need a security team to handle most of this. The same boring basics that have always mattered, like updates, strong sign-ins, and backups, are exactly what stops a cheap automated agent looking for an easy door. The businesses that get hurt are usually the ones running out-of-date software or reusing a weak password, not the ones targeted by some clever new method.

What to actually do

Start with the doors. Turn on two-step sign-in for your website admin, your hosting account, and your domain registrar, so a stolen password alone is not enough. Update your site software, plugins, and themes, and remove ones you no longer use, since each one is a possible way in. Make sure you have a recent backup stored somewhere separate from the site, and that you have actually tried restoring it once. If a host or an agency runs your site, ask them in writing what they patch and what is your responsibility, because the split is often unclear until something breaks. None of this is new advice. The report is just a reminder that skipping it is cheaper to exploit than ever.

From Kindloom Labs

Knowing which tools and accounts touch your business is half the battle. The free Small Business AI Use Case Checklist is a simple way to take stock of where AI and your accounts sit in the business.

Sources

• How one hacker used AI agents and a few thousand dollars to break into scores of sites (Reuters)
• AI agents broke into 100+ sites for one hacker at $50 each, researcher says (The Next Web)