A Dark Reading report dated 23 October 2026 describes how AI-powered tools are enabling large-scale, low-cost cyber campaigns. Over five days in September, a Chinese-speaking attacker used three different AI harnesses and both open-weight and public AI models to target 105 ecommerce sites. In many cases the autonomous hacking system compromised targets within a day, and often within hours, with Gambit Security noting that at least 27 companies were breached.
Malicious agents stole at least 600,000 payment card records from two victims, installed credit-card skimmers on five sites, and gained some level of illicit access to the remainder, including at least one Fortune 500 firm. The attackers’ average cost per completed target was about $25.46. Gambit Security’s co-founder Sa’ar Elias described how work that previously required a skilled team can now be carried out by a single person with limited prior knowledge.
The piece also cites a separate validation of AI-assisted compromise. In lab tests conducted by Silverfort using orchestrating agents and publicly available Claude Opus models, an attacker gained complete domain control in eight minutes, with total cost around $12. Industry observers say the barrier to entry for such attacks is falling, driven by cheaper initial access in underground markets (average price dropping from just over $1,400 to $429).
The article emphasises that defenders must adapt by focusing on core business processes and strengthening basic controls—particularly around authentication and access management—rather than chasing every new tool. UK-based readers are urged to consider how to protect minimum viable operations against these cheaper, faster AI-enabled threats.