Powerful new AI models are behind a growing wave of cyber attacks, experts say

A hacker kicked off an AI-driven break-in spree on Sept. 25 and then, by the accounts of researchers cited by Reuters, mostly stepped back. Over the following weeks, the agents tried to breach more than 1,200 websites on their own and succeeded at about 100 companies, including Deere, SharkNinja, and Cummins.

The bill was real, but surprisingly small. Researchers told Reuters the attack used about $5,000 in tokens drawn from DeepSeek and Anthropic’s Claude Code, which works out to roughly $50 for each successful breach. That is the ugly math behind the current wave: the human operator pays for the tools, while the AI does the exhausting part.

Jessica Ji, a senior research analyst at Georgetown’s Center for Security and Emerging Technology, says these attacks are becoming more common because the models have gotten much better over the past year or so. The coding abilities have improved, she said, and that means they can now do more cybersecurity-relevant work, like analyzing large amounts of code. They’re also more agentic, so they can use other software instead of just spitting out text.

And that changes the economics. Varun Chandrasekaran, an assistant professor at the University of Illinois’ Grainger College of Engineering, told Fortune that LLM-powered agents can keep going day and night at a fraction of the cost of human attackers. The point is not just speed. It’s persistence, scale, and cheapness bundled together.

The same argument is now playing out over open-weight models, which are publicly downloadable and customizable. Ji said attackers can use them too, and that they’re often cheaper even if they take more setup. That has pushed Anthropic CEO Dario Amodei to warn that open models could enable widespread and potentially devastating cyberattacks, and to argue for possible government limits on distribution and use. Others push back, saying the same tools can help defenders more than attackers.

Hugging Face ran into that split in July, when it was hit by an autonomous attack and first tried a closed model for defense, only to have it refuse the job because of its guardrails. It then switched to an open model from China-based Z.ai and used that to help fend off the attack. This month OpenCode had a similar fight, with a hacker’s model attacking its systems for 48 hours and some users losing as much as $1,700, before OpenCode turned to its own AI agents and kept them running 24/7. In a third attack, South Korean banks were hit, data from an estimated 68,000 people was stolen, and officials were told to harden their defenses.