Single hacker used AI agents to breach scores of websites

By Splitfeed EditorialLast updated Oct 19, 2026, 11:20 UTC

On October 19, 2026, Reuters published an exclusive report describing how a single, unidentified hacker used AI agents to break into scores of websites, completing the operation for a total cost of only a few thousand dollars. The report offers no detail about the hacker's identity, the specific sites targeted, or the precise methods the AI agents employed, but the core figures, one person, multiple AI agents, and a low four-figure budget, are the details that have driven the story's reach.

The significance of the report rests on what those numbers imply about the economics of cyberattacks. Breaching scores of websites has historically required either a skilled team, expensive tooling, or considerable time. A few thousand dollars and a single operator suggests that AI agents may be compressing all three of those costs simultaneously, lowering the threshold at which a lone, moderately resourced actor can conduct what would previously have been considered a campaign-scale intrusion. Whether the targeted sites were hardened targets or poorly maintained systems is a detail that matters enormously for interpreting the story's implications, and it remains unknown from what has been published.

None of the three camps, Pro-AI, Anti-AI, or Middle Ground, had published reactions at the time of writing. The Anti-AI camp would typically treat a story like this as direct evidence that AI capability has outpaced safety measures and access controls, pointing to the low cost as proof that harmful use is already democratized. The Pro-AI camp would likely argue that the same tools are available to defenders, that the vulnerability lies in unpatched systems rather than AI itself, and that restricting AI agents would handicap security researchers more than bad actors. The Middle Ground camp would probably call for targeted policy responses, such as API monitoring or usage thresholds, rather than broad restrictions, while acknowledging that the cost reduction documented here is a genuine and measurable shift in the threat landscape.

The arguments that would settle the core dispute include details Reuters has not yet published: the sophistication of the targeted sites, whether any AI provider's terms were violated, and whether the hacker cooperated with authorities or acted covertly. Any follow-up disclosure from Reuters, a legal filing, or a response from AI platform operators would substantially change what conclusions can be drawn.