I spend a good part of my working life hardening websites — patching WordPress installs, locking down REST APIs, cleaning up after the bots that probe every login page on the internet. So a Reuters report this week genuinely stopped me: a single hacker reportedly broke into the websites of more than 100 companies, and did most of it by handing the work to AI agents.
Not AI as a chatbot giving advice. AI agents as the workforce — given a goal, then carrying out complex steps of the intrusions largely on their own, for a campaign that reportedly cost only a few thousand dollars. If you run a website, a web app, or anything with a login page, this is the story you need to understand. Let me walk through what has been reported, why the economics matter more than the technique, and what I am changing in my own defensive habits because of it.
What Reuters reported
According to Reuters, reported on October 20, a Chinese-speaking hacker breached websites belonging to more than 100 companies after assigning AI agents much of the work. The agents handled complex parts of the intrusions with limited human involvement: instead of manually directing every technical step, the attacker could give the system a goal and let the agents carry out much of the attack sequence themselves.
Broader coverage of the same campaign put names to some of the targets, with reporting describing more than 100 breached sites including large, well-known companies — the kind of organizations with proper security teams and budgets. That detail matters. This was not an army of agents knocking over forgotten blogs with default passwords. These were real corporate targets.
And the cost figure is the part I keep coming back to: the whole campaign reportedly cost only a few thousand dollars. Hold that number in your head while we talk about what it buys.
The economics of hacking just broke
Traditional intrusion work is skilled-labour-bound. A human attacker has to reconnoitre a target, identify weaknesses, adapt when something fails, and move step by step — hours or days of expert time per victim. That labour cost is, quietly, one of the main things that has protected smaller companies for decades: most of us simply were not worth a skilled human's week.
Agentic attacks delete that protection. When an agent can be pointed at a goal and left to work through the sequence — retrying, adapting, moving to the next step without a human watching every keystroke — the attacker's cost per target collapses. One operator can run many campaigns in parallel. A few thousand dollars of compute can probe, breach, and rummage through a hundred companies.
This is the same pattern I wrote about recently with the Artex attack, where AI tooling let a tiny operation hit multiple banks. The direction is consistent: the skill floor for serious attacks is falling while the scale ceiling is rising. Defenders who budgeted for "attackers are expensive" need a new spreadsheet.
What the agents actually did — and didn't do
It is worth being precise here, because "AI hacked 100 companies" invites science-fiction readings. Per the reporting, the human still chose targets and goals. The agents executed: working through the technical sequence of an intrusion, handling steps that would previously have needed a person at the keyboard making decisions in real time.
That distinction does not make it less serious — it makes it more so. Goal-level delegation is exactly how legitimate agent tools are designed to work, and it is how I use coding agents in my own work: I describe the outcome, the agent iterates. The uncomfortable truth of 2026 is that the same loop that fixes my bugs at 2 a.m. can be pointed at your firewall. The technology is neutral; the operator's intent is not, and intent is the one thing we cannot patch.
The other side of the same coin
There is a detail I find almost poetic: this story broke the same week Microsoft rolled out new enterprise controls designed to assess individual AI agents for risk — restricting what they can change, requiring human approval, or shutting them down entirely. Agents inside companies, with legitimate access, are becoming a governance problem at the exact moment agents outside companies are becoming an attack problem.
And agents are also showing up on defense. Anthropic recently launched free vulnerability scanning for critical open-source projects, and there are already anecdotal reports of coding agents spotting hidden malware while debugging unrelated problems. The realistic picture is not "AI attacks, humans defend." It is agents on both sides, and the side with better tooling, better monitoring, and faster patching wins.
A quick reality check on the hype
Two cautions before anyone rewrites their security budget around this story. First, reporting is still developing: the full technical detail of the campaign — exactly which vulnerabilities the agents exploited, and how much was novel technique versus commodity tooling pointed at known weaknesses — has not been laid out publicly. The most likely reading, based on how these campaigns usually resolve, is that the agents were very good at executing well-understood attack steps quickly and persistently, rather than inventing exotic new exploits. That is still a serious development, but it points defenders toward fundamentals: patching, access control, and monitoring, rather than science-fiction countermeasures.
Second, do not let the scale numb you into thinking only giant companies are targets. Read the number again: more than one hundred organizations, breached by an operation costing a few thousand dollars. At that price point, the target list stops being a list of famous names and becomes a sweep. Any public-facing system with users, payments, or data qualifies — including, I would gently note, the WordPress sites, booking systems, and small e-commerce stores that people like me maintain for clients who have never once described themselves as "a target."
What I am actually doing differently
I am not going to end this with vague advice to "take security seriously." Here is my concrete checklist after reading this reporting, the same one I apply to client sites:
- Patch windows measured in days, not months. When attacks are automated, the gap between a vulnerability being known and being exploited shrinks. My WordPress sites get core and plugin updates fast, with backups first.
- Least privilege everywhere. Agents — attacking or legitimate — can only abuse the access they find. Stale admin accounts and over-permissioned API keys are the first things I audit now.
- Watch for machine-speed behaviour. A hundred probing requests with inhuman regularity is a pattern logging and rate limiting can catch — if anyone is looking. Basic monitoring beats no monitoring, every time.
- Assume breach, limit blast radius. Segment what can be segmented. A compromised brochure site should never share credentials with anything that matters.
The conversation I keep having with clients
Since this reporting landed, I have had the same conversation twice with clients whose sites I maintain, and it goes like this: "Is our site the kind they'd attack?" The honest answer is that the question has quietly changed. It used to be about whether you were worth a human's time. Now it is about whether your defences assume a human's limits — a person who sleeps, who gets bored, who tries the obvious doors once and moves on. Agents do none of those things. They try everything, patiently, in parallel, and they keep notes.
So the advice I give is equally changed. It is no longer "don't be an easy target" — it is "be a hardened target at machine tempo": updates applied within days, two-factor authentication on every admin account without exception, login attempts rate-limited and logged, file integrity monitored, and backups that are tested rather than assumed. None of it is glamorous. All of it is the difference between being one of the hundred in the next Reuters story and being a closed door the agents recorded and moved past.
Conclusion
The Reuters campaign is a milestone, but not a surprising one: one operator, AI agents doing the intrusion labour, 100+ companies breached, a few thousand dollars spent. The cost of attacking has fallen off a cliff, and it is not coming back up. For those of us who build and defend websites, the response is not panic — it is tempo. Patch faster, grant less access, monitor like machines are coming, because they are. The defenders who adapt their habits to agent-speed threats will be fine. The ones still running 2023's playbook are the next headline.
Frequently Asked Questions
What exactly happened in this attack?
Reuters reported that a Chinese-speaking hacker breached websites of more than 100 companies, using AI agents to carry out much of the intrusion work after being given goals, with limited human involvement.
How much did the campaign cost the attacker?
Reporting put the cost at only a few thousand dollars — a fraction of what equivalent human-led intrusion work across 100+ targets would have cost.
Did the AI act completely on its own?
No. The human operator chose targets and set goals; the agents executed complex technical steps of the attack sequence. That goal-level delegation is what makes the model scalable.
Why does this matter for small websites?
Because the old protection — "we're too small to be worth a hacker's time" — depended on attacker labour being expensive. Automated agents remove that protection, so small and mid-sized sites face big-company threat volumes.
What is the single most useful defensive step?
Shorten your patch cycle. Automated exploitation moves fast, so keeping core software, plugins, and dependencies current — with backups before updating — closes the window agents most rely on.
Are AI agents also used for defense?
Yes. Vendors are shipping agent-risk controls, free AI vulnerability scanning for open-source projects exists, and coding agents have already been reported spotting hidden malware during ordinary debugging work.
