AI-Powered Cyberattacks: Hacker Breaches 100+ Websites for $5,000

AI-powered cyberattacks are becoming cheaper and easier to scale, raising serious concerns for businesses worldwide. A new cybersecurity investigation has revealed how a hacker reportedly used autonomous AI agents to compromise more than 100 websites for an estimated $5,000 in AI usage costs.

According to a Reuters investigation, the campaign targeted more than 1,200 websites across several countries. The findings highlight how AI agents can automate parts of cyberattacks that previously required considerable manual effort.

The incident does not mean every website is equally vulnerable or that AI can automatically breach any system. However, it demonstrates why AI-powered cyberattacks are becoming an important concern for organizations that depend on websites, cloud platforms, and digital services.

How AI-Powered Cyberattacks Work

The hacker reportedly used an AI problem-solving platform called Cairn to coordinate autonomous agents. These agents were instructed to investigate targets and search for potential weaknesses, reducing the amount of direct human involvement needed during the campaign.

The investigation reported that the operation involved a combination of DeepSeek and Anthropic’s Claude Code.

Unlike traditional scripts that follow fixed instructions, AI agents can analyze information, adapt to new findings, and continue working through complex tasks. This flexibility can make certain types of automated attacks more scalable.

However, the success of AI-powered cyberattacks still depends on factors such as the target’s security controls, available vulnerabilities, and the tools used.

Why AI-Powered Cyberattacks Are Becoming Cheaper

One of the most concerning aspects of the reported campaign is its estimated cost.

The investigation placed AI usage expenses at approximately $5,000. That figure represents estimated model usage, not the total cost of the campaign or the financial damage suffered by affected organizations.

AI can reduce the time spent on repetitive tasks such as examining websites, reviewing technical information, and investigating possible weaknesses. This can allow an operator to coordinate more activity without needing a large team.

For businesses, the concern is that lower operational barriers could encourage more attackers to experiment with AI-powered cyberattacks.

More Than 100 Websites Reportedly Compromised

The investigation found that the hacker’s agents attempted intrusions against more than 1,200 websites, with over 100 reportedly compromised.

The reported targets included organizations connected to agricultural equipment, consumer appliances, and industrial manufacturing.

Some companies said they had taken steps to address the incidents. The precise extent of data access or theft was not clear across all reported cases.

A website compromise does not automatically mean that customer information was stolen. The consequences depend on what the attacker accessed and how the affected website connects to other systems.

What Makes Autonomous AI Agents a Cybersecurity Risk?

AI agents can work toward a goal with less continuous human supervision. In cybersecurity, this can be useful for legitimate vulnerability testing, but it can also be abused.

Three factors make AI-powered cyberattacks particularly concerning:

• Lower costs: AI can automate portions of security research and reduce manual effort.
• Greater scale: One operator can coordinate agents to investigate many targets.
• Adaptive behaviour: Agents may change their approach as they encounter new information.

These capabilities do not guarantee a successful attack. They do, however, increase the importance of securing systems before attackers discover weaknesses.

How Businesses Can Defend Against AI-Powered Cyberattacks

Organizations should strengthen their existing security practices rather than assume that AI attacks require entirely new defenses.

Important measures include:

• Update software regularly: Patch websites, plugins, frameworks, and servers.
• Protect accounts: Enable multi-factor authentication and remove unnecessary access.
• Monitor suspicious activity: Investigate unusual login attempts, requests, and data transfers.
• Review third-party services: Check the security of vendors and external websites connected to business systems.
• Conduct security assessments: Use authorized vulnerability testing to identify weaknesses before attackers exploit them.
• Prepare an incident response plan: Establish procedures for isolating affected systems and investigating potential breaches.

These measures can help reduce exposure to both traditional attacks and increasingly automated threats.

AI Is Changing Both Attacks and Defenses

AI is not inherently malicious. Security teams can use it to review logs, prioritize vulnerabilities, investigate suspicious behaviour, and respond to incidents faster.

The challenge is that attackers can use similar technology to automate parts of their operations.

As AI-powered cyberattacks evolve, businesses will need to improve their monitoring, access controls, and response capabilities. The most effective approach combines modern security tools with reliable fundamentals and trained security professionals.

Final Thoughts

The reported compromise of more than 100 websites illustrates how autonomous AI agents could change the economics of cybercrime. With an estimated $5,000 in AI usage costs, the reported campaign targeted more than 1,200 websites, highlighting the potential scale of AI-powered cyberattacks.

The full impact of the incidents remains unclear, but the lesson for businesses is straightforward: keep systems updated, protect credentials, monitor activity, and test security regularly.

As AI agents become more capable, organizations must prepare for attacks that can operate faster and at greater scale. Strong cybersecurity fundamentals remain essential to reducing that risk.