The short answer: AI agents have made hacking cheap and automatic, so attackers no longer need to choose their targets carefully. They scan everything. The good news is that the basics still work: two-factor logins, updated software, fewer forgotten accounts and keys, and a callback rule for any request involving money.
What happened this month?
In October, security researchers found a hacker using autonomous AI agents to break into company websites. According to Reuters and the research firm NorForge, the agents went after more than 1,200 sites and got into sites belonging to more than 100 companies, including well-known names like Deere, SharkNinja and Cummins.
What stood out wasn't a brand-new kind of attack. It was how little effort it took. Reuters reported that the instructions given to the agents were just a short prompt, and researchers estimated the attacker spent about $5,000 in AI usage, roughly $50 per successful break-in. The agents did the rest on their own, around the clock.
It wasn't the only case. Fortune reported a wider wave of AI-assisted attacks this month, including one on banks in South Korea that exposed data on about 68,000 people.
Why should a small business care?
For years, a lot of small business owners figured hackers had bigger fish to fry. That was partly true: a skilled human attacker's time was expensive, so they aimed it at big targets.
AI agents change that math. When an attack costs a few dollars and runs without a person watching, it makes sense to try it on everyone. In this campaign, the agents got in through ordinary weak spots: old website code, a forgotten upload form, a misconfigured setting. Those exist on small business sites at least as often as on big ones.
How do I protect my business?
None of this requires a security team. Most of it is an afternoon of cleanup and a few habits.
1. Turn on two-factor authentication everywhere that matters
Start with your email, because it can reset every other password. Then your bank, your website login, your domain registrar, your CRM and your payment tools. Use an authenticator app or a passkey where you can; text-message codes are better than nothing but easier to steal.
2. Keep your website and plugins updated, and delete what you don't use
The agents in this campaign looked for old code and leftover pieces: outdated plugins, old upload forms, test pages nobody removed. Update your website platform and plugins, and delete anything you're not using. Every unused piece is a door you're not watching.
3. Use a password manager and stop sharing logins
One unique, long password per account, stored in a password manager. If your team shares a single login for something, give each person their own account instead, so you can remove one person's access without changing it for everyone.
4. Clean up the keys that connect your tools
If your CRM talks to your calendar, your forms talk to your email, and your website talks to your payment processor, each of those connections runs on a key or a login. In this campaign, researchers found hundreds of stolen keys and passwords in the attacker's data, and some were still working. Make a short list of what's connected to what, remove connections you no longer use, and never paste keys into emails, shared docs or chat messages.
5. Remove access for people who've left
Former employees, old contractors, the web designer from three years ago. Check who still has logins to your email, website, CRM and bank, and remove anyone who doesn't need them today.
6. Verify any request for money with a callback
AI doesn't only break into websites. The FBI has warned that criminals use AI to write convincing phishing emails and clone voices to authorize payments. Make it a rule: any request to send money, change bank details or share a password gets verified by calling the person back on a number you already have. A simple code word with your team works too.
7. Back up what you can't afford to lose
Customer lists, invoices, your website. Keep a recent backup somewhere separate from the original, and check once that you can actually restore from it.
8. Be careful what you paste into AI tools
AI tools are useful, and we build with them every day. But customer information, passwords and keys don't belong in a free chatbot. Use business accounts with clear data settings, and keep sensitive details out of prompts.
Where do I start this week?
If you only do three things: turn on two-factor authentication for your email, update or remove old website plugins, and set the callback rule with your team. That covers the most common ways in.
The point
AI didn't invent new ways to break in. It made the old ways cheap enough to try on everybody. That means the businesses that get hurt won't be the biggest ones, they'll be the ones that skipped the basics.
When we set up workflow automation or a CRM for a business, every new connection is one more key to manage. If you're not sure what's connected to what in your business, that's something we look at in a free audit.
Sources: The Hacker News, Oct. 20, 2026 (citing Reuters and NorForge); Fortune, Oct. 21, 2026; FBI San Francisco.