- Towards AGI
- Posts
- AI Agents Now Hack A Company For $50. Who's Watching Yours?
AI Agents Now Hack A Company For $50. Who's Watching Yours?
one hacker, 1,200 targets, and the defense gap you should close now
Today, we're diving into:
Gen AI: One hacker's AI agents broke into 100+ company websites for about $50 each
Hot Tea: Anthropic drafts a bill that could stop a frontier model at the starting line
OpenAI: 12-hour prompt caching arrives just as inference prices start climbing
AI Agents Now Hack A Company For $50. Who's Watching Yours?
A single hacker typed fewer than 100 characters of instructions, walked away, and let AI agents do the rest. By the time a researcher noticed, those agents had broken into the websites of more than 100 companies.
According to a Reuters exclusive, the whole campaign cost roughly $5,000 in tokens. That works out to about $50 per successful break-in. Your security budget was not built for that price point.
Your Attack Surface Just Got An Autopilot.
/
Find out what an unsupervised agent could reach inside your data estate before someone else does.
If one person's agents can roam the open web unchecked, the agent economy needs something better: a trusted network where agents are verified and discover each other on purpose. That is what we are building at OpenMap: The Agent Network, the connective tissue for the world's AI agents, starting with every person and every local business. We are raising a £5M seed. Meet us at openmap.ai/investors.
The Attacker Is No Longer At The Keyboard
The campaign started on September 25 and targeted e-commerce sites across the US, Canada, Australia and Japan. As of last week, the agents had attempted more than 1,200 sites.
They ran on Cairn, an open-source AI problem-solving platform, and appeared to mix DeepSeek with Anthropic's Claude Code. A typical successful intrusion took around 23 hours, with no human steering it.
"It's not script kiddie stuff." - Snorre Fagerland, principal threat researcher at NorForge, who spotted the activity
Why This Fundamentally Changes The Math
Your defenses assume attackers have limited time and attention. A skilled human picks a few targets and works them carefully.
Agents remove that limit. They search public records, find a forgotten control panel, spot a subtle weakness and keep going while their owner sleeps. Patience used to be expensive. Now it costs a few dollars an hour.
The Wrong Reaction Is A Bigger Firewall
The instinct is to buy another perimeter tool and hope it holds. That misses where the real exposure sits.
The real bottleneck is not detection. It is knowing what each system, vendor site and agent can actually reach.
Notice that one of the affected companies traced its incident to a website run by a third-party vendor. That is the pattern you should expect: the weak point is the asset nobody remembered owning.
The Defenders Are Arming Agents Too
On the same day the Reuters story broke, Microsoft unveiled controls that treat AI agents as potential insider threats. Each agent gets a continuous risk score, and as risk rises it can be cut to read-only, forced to wait for human approval or shut down.
Microsoft now detects 60 agent types running on employee machines, up from 25. The tools are in private preview, with broader availability planned for Ignite in November.
What You Should Do This Quarter
Inventory every public-facing asset. Include vendor-run microsites, support portals and old campaign pages.
Map what sits behind each one. An exposed panel is only as dangerous as the data and systems it connects to.
Score your own agents like insiders. Give them the least access they need and downgrade them automatically when they drift.
Rehearse a machine-speed incident. If an attack runs for 23 hours, your response cannot wait for Monday.
The better alternative is to treat lineage and ownership as security controls, not documentation chores. You cannot contain what you cannot see, and you cannot see what nobody has mapped.
Building that visibility starts with trusted enterprise context. DataManagement.AI helps organizations create that foundation by unifying metadata, lineage, governance, business glossaries and knowledge assets into a single intelligence layer. It automatically discovers metadata, maps lineage across the modern data stack and identifies downstream dependencies, so you know exactly what a compromised site or rogue agent could touch.
The organizations moving first will not just block more attacks. They will know their own estate better than any agent probing it, and that is an advantage attackers cannot buy for $50.
Anthropic Wants A Judge To Be Able To Stop A Model
The company behind Claude is circulating a draft federal bill that would let the government block an AI model's release when there is a "foreseeable, imminent risk." TechCrunch reports the proposal follows Politico's first look at it on October 16.
The thresholds are stark: more than 50 people at risk of dying, or more than $1 billion in property damage. If your roadmap depends on next year's frontier model, this matters to you.
How The Brake Would Actually Work
Independent evaluators register with the US Commerce Department and test models for disaster potential.
If they find an imminent catastrophic risk, they have 72 hours to notify Commerce.
Commerce then asks a Washington, D.C., judge to halt the release. No agency could halt it alone.
The risk has to come from one of three places: a biological weapon, a cyberattack, or a model evading its own developer's controls. That last one should sound familiar after the first story in this issue.
The Open Questions Worth Watching
Evaluators could be paid by the labs they assess, as long as payment does not depend on the results. Critics will ask how that stays independent.
The metrics echo California's SB 53, and the draft goes further than industry voices such as Nvidia's Jensen Huang, who has argued no new laws are needed. Expect a long fight before anything passes.
What This Means For Your Roadmap
Most leaders read safety bills as a problem for the labs. That is the wrong reaction.
A release that can be paused by a court is a dependency you need to plan around, just like a supplier that can fail an audit.
You should design for model portability now. Keep prompts, evaluations and business rules in a layer you own, so a delayed launch shifts your timeline by weeks, not quarters.
You should also start keeping your own evaluation evidence. Regulators are moving from promises to proof, and the enterprises that can show how they test AI will clear procurement and audits faster.
The organizations that win under new AI rules will not be the ones with the newest model. They will be the ones who can switch models without breaking the business.
OpenAI Just Gave Your Agents A 12-Hour Memory For Instructions
OpenAI announced on October 20 that developers can now choose 12-hour prompt caching in its API. Shared instructions, tools and context stay cached longer, so agents get cheaper cached-input pricing even when requests are hours apart.
The timing is not a coincidence. The same week, a price tracker caught Alibaba raising DeepSeek V4 Flash output pricing from $0.40 to $1.32 per million tokens, a 230% jump, without an announcement.
The Cheap Inference Era Is Ending Quietly
When list prices start rising and vendors start selling discounts on reuse, the message is clear: how you run AI now matters as much as which AI you run.
Persistent agents re-read the same system prompt, tool definitions and policy documents thousands of times a day. Until now, a 30-minute cache meant much of that context expired between bursts of work and got billed at full price again.
The Catch In The Fine Print
Writing to the 12-hour cache costs 2.5x the normal input price, double the default 30-minute rate, according to AI Weekly's breakdown. It only pays off if the same block is reused several times inside the window.
The same breakdown notes that the 12-hour setting is not a deletion deadline. Your security team should not treat it as a data retention control.
What You Should Do With This
Separate stable context from live context. Policies and tool schemas belong in the long cache. Conversations do not.
Measure reuse before you switch. If a block is not read again within 12 hours, the longer cache costs you more.
Budget for rising list prices. Build cost alerts per agent, not just per department.
This is exactly the discipline we cover in Know Your Inference (KYI): treating inference as an engineered system with its own architecture, not a utility bill you discover at month end. Caching strategy, model routing and workload shape decide whether your agents scale profitably.
The organizations that master inference economics now will run more agents on the same budget, while competitors are still asking finance why the AI bill went up.
Journey Towards AGI
Research and advisory firm guiding on the journey to Artificial General Intelligence
Know Your Inference Maximising GenAI impact on performance and Efficiency. | Model Context Protocol Connect with us, and get end-to-end guidance on AI implementation. |
Your opinion matters!
Hope you loved reading our piece of newsletter as much as we had fun writing it.
Share your experience and feedback with us below 'cause we take your critique very critically.
How's your experience? |
Thank you for reading
-Shen & Towards AGI team