AI
A Hacker Used AI Agents to Breach 100+ Company Websites: How to Protect Yours
A report from Reuters on October 19, 2026 should make every website owner sit up. According to security researcher Snorre Fagerland of NorForge, a single Chinese speaking hacker handed most of a hacking campaign over to AI agents. The agents tried to break into more than 1,200 websites, mostly ecommerce sites in the United States, Canada, Australia and Japan. They succeeded at more than 100 companies.
The total cost, by the researcher’s estimate, was about $5,000 in AI usage. That works out at roughly $50 per successful break in. Companies named in Reuters’ review included Deere, SharkNinja and Cummins, along with smaller businesses that confirmed they were compromised.
The lesson is not that AI is evil. It is that attacks which used to need a skilled person working for days can now be run cheaply and at scale. Small business websites, which attackers once ignored as not worth the effort, are now worth it.
How the attack worked
The campaign started on September 25. The researcher began watching it around October 2 through exposed deployments of Cairn, an open source AI problem solving platform. Here is the pattern described in the reporting:
- A short instruction. The operator gave the agents a brief list of preferred tactics and then left them to it.
- Searching for weak spots. The agents probed each company’s public website and apps for known weaknesses.
- Finding another way in. When the main site held up, the agents looked for related infrastructure, such as an internet facing control panel.
- Trying for hours. They found a flaw in how a panel processed data and kept trying variations until the server ran their commands.
- Little supervision. Successful intrusions typically took about 23 hours, mostly without a human watching.
The tools reportedly included DeepSeek and Claude Code. The reporting did not name specific vulnerabilities. What stands out is the persistence. As Fagerland put it, the agents’ ability to find another route was notable, because coming up with that kind of solution is not straightforward.
Why small business websites are now targets
For years, many small businesses assumed they were too small to be worth attacking. That was never quite true, because automated bots have always scanned for old plugins. But AI agents change the maths:
- Cost per attack is falling. At around $50 per success, even a small store with a customer list is profitable to breach.
- Agents do not give up. They try alternatives for hours, which beats sites that rely on one layer of protection.
- The forgotten stuff gets found. Old staging sites, admin panels, test subdomains and abandoned tools are exactly what the agents went looking for.
This lines up with the critical PHP flaws patched on October 21, which saw millions of exploit attempts within a day. Read our PHP security update guide if you have not checked your server yet.
10 steps to protect your website from AI driven attacks
1. Patch everything, quickly
Update WordPress, plugins, themes and PHP. For Shopify, keep apps up to date and remove ones you do not use. Speed matters now because agents scan new vulnerabilities within hours.
2. Find your forgotten infrastructure
List every subdomain and server you own: staging sites, old landing pages, test stores, hosting panels, database tools. If it is not needed, take it down. If it is needed, put it behind a login and IP restriction.
3. Lock down control panels
cPanel, Plesk, phpMyAdmin and custom admin dashboards should never be open to the whole internet. Restrict them by IP, VPN or at least strong two factor authentication.
4. Turn on two factor authentication everywhere
WordPress admins, hosting accounts, domain registrars, Shopify staff and app dashboards. A stolen password should never be enough.
5. Use a web application firewall
Cloudflare, Sucuri or your host’s firewall can block a lot of automated probing. Make sure rules are set to block, not just log, and that your origin server cannot be reached directly by IP.
6. Limit what each account can do
Give staff and freelancers the lowest access they need. Remove old users. Rotate API keys that have been shared over email or chat.
7. Keep off site backups
Daily backups stored away from your server, with at least one copy you have actually tested restoring.
8. Watch your logs
Agents leave a trail: thousands of odd requests, repeated errors, unusual admin logins. A security plugin or host alert can flag this early.
9. Collect less data
Data you do not hold cannot be stolen. Do not store card details yourself, delete old customer exports and avoid keeping copies of IDs.
10. Have a response plan
Know who to call, how to take the site offline, how to restore a backup and what you must tell customers. Write it on one page.
What this means in the US, UK and Australia
United States: The campaign specifically targeted US ecommerce sites. Most US states have breach notification laws, and if card data is involved your payment processor will expect a PCI investigation. Prevention is far cheaper.
United Kingdom: The UK was not named among the targets this time, but the same tools work anywhere. Under UK GDPR, a personal data breach may need reporting to the ICO within 72 hours. The NCSC’s Cyber Essentials scheme is a practical framework for small firms.
Australia: Australian ecommerce sites were directly targeted. The Notifiable Data Breaches scheme may require you to notify the OAIC and affected customers. The Australian Cyber Security Centre’s Essential Eight is a solid checklist, even for small businesses.
Can AI help defend your site too?
Yes. The same AI that powers attacks is being used for defence. WordPress.org now uses several AI models to review plugin releases before they go out, and Anthropic and OpenAI both reported finding WordPress and PHP security bugs this month. For a small business, the practical takeaway is to use managed hosting, a good firewall and an agency or developer who keeps up with patches, so you are not fighting automated attacks by hand.
A 15 minute security check you can do today
Not every business can afford a full audit straight away. If you only have a few minutes, do these five things today:
- Log in to your hosting account and check that two factor authentication is switched on.
- Open your WordPress Users screen and delete any administrator accounts you do not recognise or no longer need.
- Check the Updates screen and apply pending plugin, theme and core updates after taking a backup.
- Search your domain on a subdomain finder or ask your developer for a list of every subdomain you own. Anything forgotten should be removed.
- Confirm your last backup exists, is recent and is stored somewhere other than your web server.
Those five steps close the doors that automated agents try first. They will not stop a determined attacker on their own, but they move you out of the easy target group, which is where most small business breaches happen.
Sources
Need a hand with this on your own site? See our WordPress development services.
Frequently asked questions
How much did the AI hacking campaign cost?
About $5,000 in AI token usage, or roughly $50 per successful intrusion, according to the researcher’s estimate.
Which countries were targeted?
Ecommerce sites in the United States, Canada, Australia and Japan.
Is my WordPress site at risk?
Any site with outdated software, open admin panels or forgotten subdomains is at higher risk. Patch, restrict and monitor.
Can Web Brick Studio secure my website?
Yes. We run security audits, patch WordPress and PHP, lock down admin panels and set up firewalls and backups. Contact us.
