One Hacker Used AI to Break Into Companies Around the World

October 23, 2026

I ended my last post with a question: if these models can accidentally break into real company systems in a single test run, how effective would they be in the hands of a hacker aiming them at 100 companies simultaneously, on purpose? It didn’t take long to get an answer.

According to Reuters, a single malicious actor pointed a swarm of AI agents at roughly 1,200 e-commerce sites across the US, Canada, Australia, and Japan, and got into more than 100 of them. A successful intrusion took about 23 hours of the agents grinding away on their own. The total token cost was an estimated $5,000. That works out to around $50 per company, or the cost of dinner at a fancy restaurant, like Olive Garden.

The one-man band

The campaign was uncovered by Snorre Fagerland, a researcher at NorForge, who spotted it through exposed deployments of Cairn, an open-source tool for coordinating multiple AI agents. The models doing the actual work reportedly included DeepSeek and Claude Code. Cairn’s author was quick to point out that it “was not designed for hacking attacks,” which is technically true, and also exactly what every tool’s author says right after it’s used for hacking attacks.

Names like Deere, SharkNinja, and Cummins showed up on the target list. Deere says it has no indication sensitive data was accessed, but across the breached sites, payment card details, personal records, and crypto were taken, and the full extent still isn’t known.

The part that should bother everyone is how little the human did. The operator gave the agents “brief tactical guidance” and let them run. You used to need a team, years of experience, and a lot of patience to pull off a campaign like this. Now you need a credit card and a vague idea of what you want. The skill floor for hacking just dropped through the basement.

Meanwhile, the rest of the week

That wasn’t the only thing on fire. This week’s roundup also included actively exploited zero-days in BeyondTrust, Ivanti, Palo Alto’s PAN-OS, and Cisco’s email gateway, a supply-chain attack that tampered with AOMEI Backupper’s update servers across 11 countries, and malicious npm packages dropping a remote access trojan on Windows developers. In Japan, a ransomware wave that started with a compromise at IDC Frontier cascaded to around 495 organizations, with AI reportedly helping the attackers write fluent Japanese phishing emails.

Notice that most of these are plain old human bugs. Bad authentication, path traversal, memory corruption, poisoned packages. Nothing exotic. That’s exactly the point: these are the kinds of flaws that an army of tireless agents can now go looking for at scale, for pocket change.

Find Bad Vulnerabilities in PHP

If a single hacker showed how cheap attacking has become, this week’s PHP scramble showed how cheap finding the holes has become.

PHP is the programming language running a huge chunk of the internet, by some estimates over 70 percent of websites (Although a large chunk of that number is dead websites that haven’t been updated in years). This week, the world found out about two critical flaws in it, nicknamed “PHP2Shell,” each rated 9.2 out of 10 for severity. Both were found by security firms using AI. Then Dan Lorenc, whose company Chainguard builds secure software, said his team found the same issue on their own in a single night. Their prompt was “find bad vulnerabilities in PHP.”

That’s it. No elaborate jailbreak, no genius hacker in a hoodie. That’s roughly the same effort I put into asking my phone where the nearest gas station is. A flaw hiding in software that’s been around for decades, in code going back to PHP 5.4 in 2012, came out with one sentence.

The fallout wasn’t small, either. Before the fix was even out, governments started pulling their own websites offline as a precaution: the Netherlands, Finland, France, Belgium, Denmark, and Canada. South Korea raised its cyber alert level. Amazon said it had already spotted attackers trying to exploit the flaw before it was made public. When entire countries would rather have no website than a vulnerable one, it’s fair to say the stakes have changed.

PHP released patches on Wednesday. If you run anything built on PHP (such as WordPress sites), now would be a great time to update. The most recent safe version is PHP 8.5.12 (or 8.4.27, 8.3.36 or 8.2.35 for older versions).

Dan Lorenc posts on LinkedIn to explain that his team independently discovered these huge security vulnerabilities in PHP programming language by prompting an AI model with "Find bad vulnerabilities in PHP"

All human code is hackable code

Models are already better at finding these flaws than we are at preventing them. Back in February, Anthropic reported that Claude Opus 4.6 turned up more than 500 high-severity vulnerabilities in open-source software, much of it code that humans had been reviewing for years.

Put that next to this week’s news and the math gets uncomfortable. If finding a hole is cheap and fast, then every legacy codebase is a liability. Every old PHP site, every WordPress plugin that hasn’t been updated since 2019, every abandoned npm package that a thousand other packages depend on. As someone who builds websites for clients, I can’t help but think that every site I’ve ever touched is now a $50 target.

Fighting code with code

The logical response is to have the models rewrite the code themselves, and it’s already happening. In September, Google’s security team had Gemini port giflib, a roughly 3,000-line C image library, to memory-safe Rust in a single shot. Humans cleaned up the tricky pointer handling, then they tested the result against more than 30 million GIF files and 200 million fuzzing runs. Over at Google DeepMind, an agent called CodeMender has already upstreamed 72 security fixes to open-source projects, and proactively hardened libwebp, the image library behind a 2023 zero-day that was used in spyware attacks.

Follow that to its conclusion and you get an arms race where both sides are models, and the humans are mostly just setting the budgets. One model writes the code, another model attacks it, a third model patches it.

And this is where I think the open-weights debate gets more interesting than the usual national security talking points. If nearly all code ends up written and defended by LLMs, then the models doing the defending have to stay meaningfully ahead of the models anyone can download and point at it. Defense only works if there’s a real gap between the best closed production models and whatever open-weight model a hacker can run on rented GPUs. If that gap closes, the defenders have no edge, and it all comes crashing down. That’s a real argument for restricting open weights, and it has nothing to do with which country made them.

The coming black box

Here’s where it leads. Software that is written by models, patched by models, and defended against models will inevitably drift past the point where humans can audit it. Not because anyone decides to lock us out, but because the volume and the speed outrun us.

Our researchers can try to keep up. They can read the code, and when the code gets too dense, they can ask the models to explain it. But then we’re trusting the explainer, which is the same kind of system we were worried about in the first place. Right now, CodeMender has humans review every single patch before it goes out. That’s the right call for a few patches. Does it still hold at 10,000? At 10 million?

We’ll keep trying. We’ll build better tools to analyze the code, and we’ll have the models walk us through it line by line. But at a certain point, we’ll inevitably behind.

It’s probably fine

To be fair, this week’s campaign wasn’t some quantum superintelligence inventing brand-new exploits. From what’s been reported, the agents spent around 23 hours per site grinding for weaknesses. Keeping your software updated, using strong passwords, and not leaving debug pages open to the internet still mitigates a lot of these issues.

The problem is that most people won’t do it. The majority of websites out there are run by small businesses, hobbyists, and freelancers who set up a site years ago and haven’t touched it since. Plenty of them won’t hear about PHP2Shell, and many who do won’t update. Those sites will be easy pickings for anyone with a few AI agents and a relatively small budget. Over time, the internet could shrink into a small corner of secure websites run by companies that can afford dedicated security teams, while the amateurs get wiped out one break-in at a time.

Sources: