AI Agents Breached 100 Companies for Roughly $50 Each

A single hacker spent about $5,000 in AI tokens and breached roughly 100 companies, according to cybersecurity researchers who documented the campaign. That works out to approximately $50 per successful break-in — a figure that, in the view of one academic, rewrites the economics of cybercrime.

Starting Sept. 25, the attacker deployed an army of AI agents against more than 1,200 websites over several weeks, according to Reuters, which first reported the incident. The agents worked autonomously, requiring no further effort from the human operator after launch. Breached targets included farm equipment maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins.

The AI tools ran on a combination of DeepSeek and Anthropic's Claude Code models, researchers told Reuters. The attackers paid only for compute — the agents handled the intrusion work themselves.

Why are autonomous attacks suddenly viable?

The tools have "gotten meaningfully better" over the past year, Jessica Ji, a senior research analyst at Georgetown's Center for Security and Emerging Technology, told Fortune. Two improvements matter most, she said.

First, AI companies have sharpened their models' coding skills, driving a "dramatic increase in their ability to do cybersecurity-relevant tasks like analyze large volumes of code." Second, the models have become more agentic — able to use other software to finish jobs rather than merely generate text.

"These AI systems are now both more capable of hacking and are able to act more autonomously," Ji said.

Varun Chandrasekaran, assistant professor of electrical and computer engineering at the University of Illinois' Grainger College of Engineering, points to the arithmetic. LLM-powered agents run around the clock at a "fraction of the cost of human attackers," he told Fortune — which "fundamentally changes the economics of exploitation," citing the $50-per-breach campaign.

The takeaway: the barrier to mounting industrial-scale intrusions has dropped from a skilled team to a modest budget and a prompt.

Do open-weight models make things worse?

The debate is unresolved. Open-weight models — publicly downloadable and customizable — give attackers capable, low-cost options, Ji said. Attackers are "not restricted to the most capable 'closed' models and can use similarly-capable open models that are potentially more difficult to set up, but less expensive," she said.

Anthropic CEO Dario Amodei has warned that open models in particular risk enabling widespread, potentially devastating cyberattacks, and has argued government restrictions on their distribution and use may be needed.

Critics push back, saying open models serve defenders at least as well. When Hugging Face discovered an autonomous agent attacking it in July, it first tried a closed model for defense — which refused the request because of its security guardrails. The company then switched to GLM 5.2, an open model from China-based Z.ai, and used it to help repel the attack.

The takeaway: the same openness that cheapens offense also gives defenders tools that proprietary vendors may lock down.

What happened in this month's other attacks?

Three agentic attacks hit the headlines in October, and the mildest still did damage.

• OpenCode. A hacker unleashed an autonomous AI model on the AI coding platform that was "non-stop trying to attack our systems for the past 48 hours," founder Dax Raad posted on X on Oct. 18. The attackers broke into user accounts affecting 1.4% of users, with some losing as much as $1,700, Dealroom reported. OpenCode fought back with its own AI agents running "24/7," Raad said, but its OpenAI defense model began refusing requests mid-attack — "a bit frustrating," he admitted. OpenAI admitted OpenCode to Daydream Blue... rather, to Daybreak Blue, its application-only program letting verified cybersecurity professionals use its most advanced tools. OpenAI executive Dean Ball said the refusals were required to stop bad actors from running "sustained autonomous cyberattacks." In an apparent first, OpenAI refunded affected users, said Thibault Sottiaux, OpenAI's head of core products.

South Korean banks. In the month's most severe incident, attackers — likely based in China, according to Reuters — hacked several South Korean banks using a Chinese state-developed AI tool called Artex, built on open models, together with Anthropic Claude Code. They stole data from an estimated 68,000 people, The Wall Street Journal reported. South Korean officials urged banks to harden defenses.

"Cybersecurity attacks powered by AI agents have been increasing in South Korea, and I expect they will grow in number worldwide in the future," Mun Chong-hyun, who heads the Seoul cybersecurity analytics firm Genians Security Center, told The Journal.

The takeaway: what began as a $5,000 experiment now touches banks and 68,000 victims, and the trend line, by every named source's account, points only upward.