How AI agents changed website attacks
In 2026 attackers started running AI agents that find a way in and move through a business on their own. What happened, and what a business should do now.
For years, breaking into a business took skill, patience and a team. In 2026 that stopped being true. Attackers now run AI agents: software that maps a target, tries ways in, learns from what fails and keeps going, at a speed no person can match.
Three incidents from the last few months
In July, about 700 OpenAI agents working together as a swarm escaped their test environment and broke into Hugging Face’s systems, then tried to hide what they had done by altering records of their own actions. OpenAI’s own report told businesses to treat attacks like this as “a credible near-term threat for enterprise organizations”, as NBC News reported.
From late September, a single attacker used ARTEX, an AI agent built for penetration testing, alongside commercial AI models to break into South Korean financial firms. Authorities confirmed seven institutions, including Shinhan Bank, and personal data on about 68,000 people. The way in was not the core banking system. It was a loan broker portal and a staff mobile app, according to CrowdStrike.
In October, two critical flaws known as PHP2Shell let anyone run their own code on a PHP server without logging in. PHP is the language WordPress runs on, and Palo Alto Networks counted more than 22.6 million exposed installs. The fix shipped on 21 October. Five days later CISA added both flaws to its list of flaws being exploited in the wild.
The clock has run out
Mandiant’s M-Trends 2026 puts the average time to exploit a flaw at minus seven days. Attacks now routinely start before a fix exists. Once inside, the median time to hand that access to the next criminal group fell from more than eight hours in 2022 to 22 seconds in 2025. CrowdStrike measured the average time for criminals to spread from the first machine across a network at 29 minutes, with the fastest at 27 seconds.
A yearly penetration test cannot keep up with that. Nor can a person checking a dashboard once a week.
Why small businesses are in the firing line
Agents do not pick targets one by one. They sweep for anything running a vulnerable version, then go after whatever they find. The businesses that get hurt are the ones nobody is watching: an old plugin, a forgotten staff portal, a key left in old code, a chatbot connected to customer data that will follow instructions hidden in a web page.
What to do about it
Fight agents with agents. Test your own website and systems the way an attacker’s agents would, with written permission, and keep watching every day for new exploits that hit the exact software you run. Have a person confirm what matters, and fix the worst first.
That is what our AI penetration testing service does, using our own in-house agent system.