AI Agents Are Already Hacking Websites. Can Businesses Keep Up?

AI-powered cyberattacks are already happening, with hackers using AI agents to break into websites and researchers uncovering critical software vulnerabilities with AI assistance. These developments raise concerns about how quickly attackers can exploit security weaknesses and whether businesses can keep pace.

On October 23, Andrew Yang warned that AI-powered cyberattacks are about to become historically severe, asking, “Which hacking story?” His concern follows reports of AI agents compromising more than 100 websites and the discovery of critical PHP2Shell vulnerabilities that could expose affected servers to serious attacks.

AI is reducing the time, expertise, and resources required for sophisticated cyber activity, potentially making these threats more accessible to attackers.

But are these developments the beginning of a much larger wave of AI-powered cyberattacks?

The evidence confirms that AI-assisted cyberattacks are already underway, although the scale of future threats remains uncertain.

For individuals and businesses without dedicated cybersecurity teams, that uncertainty raises an immediate concern: How can they protect themselves against threats they may not even know exist?

AI-powered cyberattacks use artificial intelligence to help identify security weaknesses, develop exploits, and carry out intrusions, allowing attackers to automate complex tasks that previously required more human involvement.

AI-assisted cyberattacks are no longer hypothetical. Recent investigations show attackers using AI systems to identify vulnerabilities, develop exploits, steal credentials, and carry out operations with surprisingly little human involvement.

In one campaign uncovered by Anthropic, attackers manipulated Claude Code into believing it was conducting legitimate cybersecurity testing. The AI then examined targeted organizations' systems, identified valuable databases, wrote exploit code, and attempted to gain access. According to Anthropic, it also harvested credentials, created backdoors, and extracted private information.

The campaign targeted approximately 30 organizations, including technology companies, financial institutions, and government agencies. Anthropic estimated that Claude performed 80% to 90% of tactical operations, with humans intervening at only a handful of critical decision points. Anthropic reported successful intrusions in a small number of cases but did not disclose an exact figure.

An October 19 Reuters investigation revealed another example. A Chinese-speaking hacker reportedly used an open-source AI platform called Cairn to coordinate agents targeting more than 1,200 websites, including those associated with Deere, SharkNinja, and Cummins.

In one reported intrusion, the agents failed to find weaknesses in a company's main website. Rather than stopping, they searched digital records for related infrastructure, discovered an exposed control panel, and eventually exploited a weakness that allowed malicious commands to run on the server.

The agents reportedly compromised more than 100 websites, using approximately $5,000 in AI services, including what appeared to be a combination of DeepSeek and Claude Code. Reuters could not determine how much data, if any, was stolen. The striking detail is that one individual reportedly orchestrated attacks across more than 1,200 targets without assembling a large hacking team.

Google Threat Intelligence has documented another concerning capability: AI-assisted development of previously unknown security exploits. In one investigation, researchers identified a malicious Python script targeting a vulnerability in a popular web-based server administration tool. The exploit could bypass two-factor authentication if an attacker already possessed valid login credentials, potentially allowing access without the additional verification normally required.

Google expressed high confidence that an AI model helped develop an exploit for this previously unknown vulnerability, known as a zero-day exploit. Researchers based that assessment partly on distinctive characteristics of the code, including unusually detailed explanations and a fabricated vulnerability severity score. However, Google did not establish which AI model was used. The attackers were reportedly planning a large-scale exploitation campaign, but Google's researchers worked with the affected vendor to address the vulnerability and disrupt the operation.

These cases reveal a significant shift: AI is moving beyond advising hackers and writing code to performing extended sequences of offensive activity, sometimes continuing for hours with minimal human supervision. The human attackers still determine the objectives, but AI is increasingly capable of carrying out the work.

On October 21, cybersecurity researchers disclosed critical flaws in PHP, the programming language used by approximately 70% of websites worldwide, according to security firm Wiz. The security weaknesses, known as PHP2Shell, could allow attackers to take control of vulnerable website servers or steal sensitive information.

PHP is used to run popular website platforms, including WordPress, Drupal, and Joomla. Because the weaknesses were found in PHP, websites using these platforms could also be affected.

In controlled tests, Wiz researchers successfully used the weaknesses to run malicious commands on vulnerable WordPress, Drupal, and Joomla servers without needing login credentials. They also found that sensitive information, including passwords and authentication tokens, could potentially be retrieved from server memory.

AI dramatically accelerated the research. Using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, researchers identified weaknesses, developed working exploits, and tested how those weaknesses could be exploited across different PHP-based website platforms. According to Wiz, a single researcher accomplished in one week what previously would have taken a world-class team months, with some exploits developed and adapted in hours.

The discovery involved overlapping research efforts. Wiz and OpenAI independently investigated the PHP weaknesses. Security researcher Calif identified a critical flaw using GPT-5.6 Sol through OpenAI's Patch the Planet initiative, while Wiz uncovered four specific exploitable bugs. Researchers warned that additional variations of the underlying problem could exist.

Wiz first identified the weaknesses on August 19 and reported them to PHP's security team on August 24. The findings remained confidential while developers worked on fixes, allowing security patches to be released alongside the public disclosure on October 21.

Both research efforts contributed to a coordinated response with PHP's security team, which developed the fixes. Technology providers, including Cloudflare, AWS, and Google Cloud, helped prepare additional protections for customers.

The potential exposure was enormous. Wiz reported that every PHP version released over the preceding decade was affected by at least one of these weaknesses. PHP released security patches on October 21, urging affected users to update their software.

Although researchers confirmed that the weaknesses could be exploited in testing, the available evidence does not establish how many websites, if any, had already been compromised through PHP2Shell.

The discovery illustrates both sides of AI's growing cybersecurity capabilities: AI helped defenders uncover and address longstanding weaknesses, but similar tools could also help attackers exploit them at unprecedented speed.

Cyberattacks have been automated for years, with malicious software capable of scanning networks and attempting intrusions around the clock. What AI agents add is the ability to evaluate results, change tactics, and continue pursuing an objective without requiring a human to direct every step.

This matters because traditional automated attacks generally follow predefined instructions. AI agents can potentially investigate why an approach failed, identify alternative targets or weaknesses, and develop another strategy. As the Reuters investigation illustrated, an unsuccessful attempt against one website can lead agents to search for other ways into the same organization's systems.

The result is a potentially more persistent and adaptable form of cyberattack. An AI agent doesn't need to stop working because its operator is asleep or because its first attempt failed. Depending on its instructions, tools, and available resources, it can continue investigating and attempting new approaches on its own.

That creates a difficult challenge for defenders. A security team might successfully block one attempted intrusion, only to face additional attempts targeting different weaknesses at machine speed. Meanwhile, organizations must identify vulnerabilities, evaluate potential exposure, install patches, and confirm that their systems are protected, often while attackers are actively searching for new weaknesses.

The concern is that AI could compress the time between discovering a weakness and attempting to exploit it, leaving defenders less time to respond. A vulnerability affecting widely used software could potentially expose numerous organizations before they have completed their updates.

Security researchers are also using AI to accelerate vulnerability discovery and strengthen protections. However, those advances don't automatically reach every organization, particularly smaller businesses without in-house cybersecurity teams that depend on outside providers to maintain their systems.

For businesses, the question becomes increasingly urgent: Can their cybersecurity defenses identify and respond to threats as quickly as AI agents can adapt and continue attacking?

Andrew Yang has warned that AI-powered cyberattacks are about to become historically severe. But are cyberattacks actually becoming more dangerous, or are AI's emerging capabilities making the future look more threatening?

Recent cybersecurity data offers some reasons for concern.

According to Google Threat Intelligence, researchers recorded an average of 18 exploited vulnerabilities per month from January through August 2026, compared with 10.5 per month in 2025. During the first eight months of 2026 alone, Google documented 141 distinct vulnerabilities that had been disclosed and exploited, surpassing the 127 recorded throughout all of 2025.

The number of observed zero-day vulnerabilities being exploited also increased, from an average of 8 per month in 2025 to 11 per month during the first eight months of 2026. Zero-day vulnerabilities are particularly concerning because attackers exploit previously unknown security weaknesses, potentially before developers have fixes available.

These statistics measure exploited software vulnerabilities rather than the total number of cyberattacks or victims. The increase is particularly concerning because AI is making it faster and easier to discover weaknesses, develop exploits, and conduct attacks at scale. Although Google's figures do not isolate AI's contribution, the documented capabilities show how the technology could accelerate an already growing threat.

What makes Yang's warning worth examining is the combination of these trends with documented AI-assisted hacking capabilities. Attackers are gaining tools that can automate increasingly sophisticated operations at a time when researchers are already observing more exploited vulnerabilities.

Whether this develops into the historically severe wave Yang anticipates remains uncertain. But the evidence provides a reason for businesses to evaluate their defenses now, rather than waiting for that prediction to become reality.

AI-powered cyberattacks may be becoming more sophisticated, but many of the most effective precautions remain the same. The challenge is understanding which protections individuals and businesses can manage themselves and which depend on their technology providers.

Strong account security remains an important first defense. Use unique passwords for important accounts, enable multifactor authentication wherever possible, and consider passkeys when supported. These measures can make stolen passwords less useful to attackers, although no authentication method eliminates every risk.

Software updates are equally important. The PHP2Shell vulnerabilities illustrate why security patches matter: Even a website with strong passwords can remain exposed if the software running its server contains an exploitable weakness. The National Security Agency (NSA) has urged organizations to identify PHP-dependent systems, apply the relevant patches promptly, and monitor additional security updates from software vendors.

Individuals should also be cautious about unexpected messages, links, and requests for sensitive information. AI can help attackers create more convincing phishing emails and impersonation attempts, making it important to verify unusual requests through a trusted communication channel.

For small businesses, one of the most important steps is understanding who is responsible for securing their technology. Business owners can protect their accounts, review which employees or contractors have access, and remove permissions that are no longer needed. But companies using hosted websites, email services, or other cloud platforms generally depend on their providers to secure the underlying infrastructure and install server-level patches.

Businesses can take several steps to evaluate those providers. Check whether they publish security policies, independent security audit reports, or incident-status updates. Ask how quickly critical vulnerabilities are identified and patched, whether customers are notified when their data or services are affected, and what steps customers should take following an incident.

Businesses managing their own websites should also confirm who maintains their hosting environment, PHP software, plugins, and other components requiring security updates.

These checks cannot guarantee that a provider is secure, but they can help businesses identify gaps, ask better questions, and decide whether additional precautions are necessary.

The goal is to reduce preventable risks while making sure the companies responsible for protecting essential systems are doing their part.

AI-powered cyberattacks are already happening, and documented cases show how AI can help attackers operate faster, at lower cost, and across more targets. Andrew Yang's warning about a historically severe wave of attacks remains a prediction, but the capabilities driving his concern are real.

For individuals and small businesses, one of the most unsettling realities is how much of their cybersecurity depends on third-party providers. Even businesses that follow recommended security practices can be exposed if a company hosting their website, email, or other essential services fails to address a critical vulnerability.

That dependence doesn't leave businesses powerless. They can reduce their exposure, evaluate the security practices of their providers, and make informed decisions about which companies they trust with their operations. These precautions cannot eliminate every threat, but they can reduce risk and improve a business's ability to respond when something goes wrong.

As AI expands attackers' capabilities, businesses should expect greater transparency and accountability from their technology providers. The question is whether those defenses can keep pace as AI makes sophisticated attacks easier to carry out.

Q: How can I protect my business from AI-powered cyberattacks?
A: Small businesses can reduce their risk by using strong, unique passwords, enabling multifactor authentication, keeping software updated, and limiting who can access important accounts. They should also check how their website hosts, email platforms, and other technology providers handle security vulnerabilities, install patches, and notify customers about incidents. These precautions reduce risk but cannot prevent every attack.

Q: Can AI agents hack websites on their own?
A: AI agents can carry out many steps of a cyberattack without a person directing every action. They can investigate weaknesses, test approaches, and adjust tactics based on results. However, the documented attacks discussed in this article involved human operators directing or initiating the activity. AI performing attack steps autonomously does not necessarily mean it independently decided to launch the attack.

Q: Are WordPress, Drupal, and Joomla websites vulnerable to PHP2Shell?
A: Yes, websites running WordPress, Drupal, or Joomla could be affected if they use vulnerable versions of PHP. Researchers demonstrated that PHP2Shell weaknesses could be exploited on servers running these platforms, potentially allowing attackers to execute malicious commands or access sensitive information. PHP released security patches on October 21, 2026, making it important for website administrators and hosting providers to verify that affected systems have been updated.

Editor’s Note: This article was created by Alicia Shapiro, CMO of AiNews.com, with writing support, AEO/GEO/SEO optimization, image concept development, and editorial structuring support from ChatGPT, an AI assistant. All final editorial decisions, perspectives, and publishing choices were made by Alicia Shapiro.