On September 25, a hacker set off an army of AI agents that, over several weeks, attempted to compromise more than 1,200 websites, according to cybersecurity researchers. The agents, powered by tokens from DeepSeek and Anthropic's Claude Code models, cost about $5,000 to run and successfully breached roughly 100 companies, including farm equipment maker Deere, appliance manufacturer SharkNinja, and engine producer Cummins.
The economics of these attacks are transforming the threat landscape. Jessica Ji, a senior research analyst at Georgetown's Center for Security and Emerging Technology (CSET), told Fortune that autonomous attacks are becoming more common because the tools have "gotten meaningfully better" over the past year. She cited improvements in coding skills and a move towards agentic capabilities, meaning models can use other software to complete tasks. "These AI systems are now both more capable of hacking and are able to act more autonomously," Ji said.
Varun Chandrasekaran, Assistant Professor at the University of Illinois' Grainger College of Engineering, noted that agents powered by large language models can run continuously at a "fraction of the cost of human attackers." This, he said, "fundamentally changes the economics of exploitation."
The trend accelerated in October. An autonomous AI agent launched a 48-hour attack on OpenCode, an AI-powered coding platform. "Non-stop trying to attack our systems for the past 48 hours," OpenCode founder Dax Raad posted on X. The agent broke into user accounts, affecting 1.4% of users, and spent their money, with some people losing as much as $1,700. OpenCode fought back with its own AI agents but initially saw its defense models refuse requests. OpenAI, after granting access to its advanced Daybreak Blue program, refunded the affected users in what appears to be a first.
In the most severe incident reported, South Korean banks were breached by hackers likely based in China. They used both Anthropic's Claude Code and a Chinese state-developed AI tool called Artex, built on open models. Data from an estimated 68,000 people was stolen. "Cybersecurity attacks powered by AI agents have been increasing in South Korea, and I expect they will grow in number worldwide in the future," said Mun Chong-hyun, head of Genians Security Center, a Seoul cybersecurity analytics firm.
The rise of these attacks has sharpened the debate over open-weight AI models, which are publicly downloadable and customisable. The wide availability of low-cost, powerful open models is one reason Anthropic CEO Dario Amodei has warned they pose a risk. However, proponents point to a case where Hugging Face successfully defended itself against an AI agent by using an open model after a closed model refused the defensive task due to its security guardrails. OpenAI executive Dean Ball said such refusal was required to prevent bad actors from using models for "sustained autonomous cyberattacks."