AI Hacks Come Thick and Fast, Overwhelming Internet Defenses

BY ROBERT MCMILLAN
24 loka 2026

The pace and volume of the attacks are overwhelming cyber defenses.
The AI-powered hackers began stealing from Colin Parsons at 11 p.m. on a recent Friday night.
The next morning, the startup founder woke up to see about 50 email messages, each one saying he had been charged a few more dollars for Anthropic and OpenAI’s services. The bills ran to $449.
Parsons is just one of the latest victims in a wave of AIpowered attacks that has flooded the internet in recent weeks, as hackers increasingly turn to agents and AI hacking tools that make intrusions faster and harder to track.
“We’ve been seeing an explosion of these agentic adversaries,” said Adam Meyers, a senior vice president with the cybersecurity firm CrowdStrike. “We’ve found advanced adversaries using this; we’ve found very unsophisticated adversaries using this.”
The increase in hacks is part of a dizzying AI-driven acceleration of cybersecurity threats that is rippling around the world.
At the same time as new tools speed up hackers, cyber defenders are racing to fix the fast-growing volume of security bugs discovered by AI, before hackers can exploit the new flaws.
On Wednesday, organizations rushed to patch newly uncovered bugs that could allow takeover of as many as 70% of the world’s websites. Hackers are actively trying to break into websites by exploiting these flaws, Amazon says.
The National Security Agency and Federal Bureau of Investigation told companies that couldn’t immediately patch the web bugs to
simply pull the plug on their websites.
Government-run websites in countries such as Canada, Belgium, France, the Netherlands did just that. The imageposting message board 4chan suspended comments on its site ahead of the patches.
The pace and volume of the AI-powered attacks are starting to overwhelm the incident-response firms that respond to cyber breaches. Pundits are referring to the month as “Black October,” and many in the field are predicting more to come.
“We expect that there’s going to be a massive number of compromise disclosures in the coming weeks and months,” said Steven Adair, president of the cybersecurity firm Volexity.
Incident responders such as Adair say that AI tools are now being used by nationstate hackers from China and Russia as well as criminals looking to steal data and install ransomware.
One of the tools they are using is a Chinese opensource hacking tool called Artex, which uses artificial intelligence to automate the process of breaking into a computer network.
This week Microsoft said that “threat actors across multiple geographic regions” were using Artex to speed up attacks on hundreds of companies. This month, a cyberattack used Artex to steal data on about 68,000 people from South Korean banks.
Hackers are using AI for reconnaissance, to analyze swaths of data they steal and even to rapidly build exploit code that can be used to break into networks, said Sherri Davidoff, founder of the securityconsulting firm LMG Security.
Every three months, Davidoff works with data-breach services company NetDiligence to poll a group of her peers about the techniques they are seeing in real-world cyberattacks.
A year ago, few saw any signs of AI use. During the past quarter, it has become routine, she said.
This year, researchers at the cybersecurity firm Sophos gained access to systems used by a Russian-speaking ransomware group calling itself Aurora and they were able to observe things as the group evolved and became increasingly dependent on AI.
At first the hackers used AI to build tooling and infrastructure to host their ransomware attacks. Shortly after, they were using it to sniff around corporate networks they had hacked into, looking for ways to break into other accounts.
The Russian ransomware group also shifted over the course of the year from proprietary models like Anthropic’s to new open-source ones like China’s Kimi models from Moonshot AI, said Colin Cowie, manager of threat intelligence with Sophos.
“The pace that they operate at is faster than the average human,” Cowie said.
The hackers accessed the AI models using a $200-permonth license from AI-coding service Cursor, Cowie said.
It isn’t clear what specific tools Colin Parsons’s hackers used, but they were looking for online credentials that could be used to obtain AI services.
Parsons’s unauthorized purchases were made using credentials Parson had stored with an AI-coding site called OpenCode.
Starting on Oct. 16, OpenCode was locked in a “non stop” AI-fueled cyberattack, the company’s co-founder, Dax Raas said on X.
Later he added, “damn we basically need agents going 24/7 because that’s what they have.”
OpenCode representatives didn’t reply to messages seeking comment.
When Parsons fired up his Discord messaging app and went to OpenCode’s customer support channel, it was flooded not with support queries but nonsensical messages saying things like, “Yo,” or “Delete telegram.” A new one would pop up every two seconds. When Parsons posted a note about the fraudulent charges, it was quickly buried by the nonsense.
He tagged OpenCode in a post on X, asking, “have you guys been hacked?”
Soon other OpenCode users said they had been hit too.
“Yep—same thing—$1700,” wrote one.
“same here,” wrote another.
“I’m very pissed off, my keys were leaked,” a third said, adding that his OpenAI account was suspended.


Shared via <a href=http://www.pressreader.com>PressReader.com</a> – Connecting People Through News <p><strong>PressReader &ndash; Connecting People Through News</strong>.</p><p>NewspaperDirect Inc. dba PressReader, 200-13111 Vanier Place, Richmond BC V6V 2J1, Canada<br /></p><p>&copy;2003-2026 PressReader, All rights reserved. <a href=http://www.pressreader.com/help/TermsOfUse>Terms of Use</a> &nbsp;|&nbsp; <a href=http://www.pressreader.com/help/PrivacyPolicy>Privacy Policy</a>