Key Takeaways
- A researcher at NorForge found one hacker used AI agents to try more than 1,200 online shops and break into more than 100, at roughly $50 per success and about 23 hours of unattended work
- PHP patched two flaws that let an attacker run commands without logging in; Wiz says every PHP version from the last decade is affected, including a standard WordPress setup, and attack attempts started before the fix was public
- Microsoft said a group it links to the Chinese state used the ARTEX testing tool to reach customers' Microsoft 365 accounts through ConnectWise apps those customers had already approved
- Anthropic released Claude Duet, a background assistant that can draft unpaid-invoice reminders and prep payroll, and that asks before it sends, pays, signs, or deletes
- The weak spot is rarely the thing you look at every day — it is the forgotten site, the connected app, or the assistant you have not limited
Week of October 19–25, 2026
Four things happened in AI between October 19th and the 25th that are worth five minutes of your time as someone who runs a business.
Three of them are about the same thing: AI made attacking a business cheaper and faster. The fourth is AI doing your admin, with your sign-off.
This is Last Week in AI — the signal, not the noise. Four stories operators need to understand, and what each one means for how you run your business.
Story 1: One hacker used AI agents to break into more than 100 company websites
On Monday, Reuters reported on findings from Snorre Fagerland, a researcher at the security firm NorForge. A single Chinese-speaking hacker set a team of AI agents loose on online shops in the US, Canada, Japan, and Australia. The agents tried more than 1,200 websites and got into more than 100.
Fagerland estimated the whole campaign cost about $5,000 in AI usage, roughly $50 per successful break-in. He called that a rough figure. A successful break-in took about 23 hours, with the agents working on their own the whole time.
Reuters named Deere, SharkNinja, and Cummins among the targets, and two smaller businesses confirmed they were hit. Deere said it saw no sign that sensitive information was accessed. SharkNinja said the attack hit a standalone product-support site and was contained. Cummins said it was looking into a possible attack on a website run by one of its vendors. Reuters could not establish how much data, if any, was taken.
In one case, the agents found no way into a company's main website, so they went after a control panel connected to it and got in after hours of trial and error. "It's not script kiddie stuff," Fagerland told Reuters, meaning this was not amateur work.
What it means for operators: hacking used to cost a skilled person's time, so attackers picked big targets. At about $50 a success, with software doing the work overnight, a small business website is worth a try. "We're too small to bother with" was always thin protection. This week it got thinner. Notice where the agents got in, too: not always the main website, but the forgotten thing attached to it.
Story 2: A flaw in the software behind most websites, found with help from AI
On Wednesday, PHP released fixes for two serious flaws. PHP is the software that runs WordPress, Joomla, and Magento, and it powers nearly 70% of websites whose server software is known, according to W3Techs. The flaws let an attacker run commands on a web server without logging in.
The security firm Wiz, which found them, says every version of PHP released in the last decade is affected, and it showed the attack working against a standard WordPress setup. Wiz credits AI with much of the work. It says Google's Gemini "made an invaluable contribution to finding the vulnerability," and that AI cut the effort needed to turn the flaws into a working attack. One researcher did in a week what would have taken a team months.
Attackers did not wait for the fix. Amazon says its security sensors caught an attempt to use the flaw on October 17th, four days before it was made public, and public attack code appeared hours before the fix came out. Amazon says it is not yet clear whether any of those attempts succeeded against real websites. PHP 8.1 and older versions get no official update.
What it means for operators: you don't need to know what PHP is. You need to know who keeps your website updated. AI is now finding old flaws faster than they used to be found, and the time between a fix coming out and attackers trying the flaw has shrunk from weeks to hours. The websites most at risk are the ones nobody has touched since they were built.
Story 3: Attackers used an AI tool to reach Microsoft 365 accounts through ConnectWise
On Wednesday, Microsoft said a hacking group it links to the Chinese state broke into ConnectWise, an IT services company, through its Cloud Backup service. It was part of a campaign against hundreds of organizations around the world.
The group used ARTEX, a free tool built for testing a company's defenses. It can run on any AI model and carry out steps on its own, such as scanning, guessing passwords, and pulling out data. From ConnectWise, the attackers reached customers' Microsoft 365 email and files through apps those customers had already approved, without anyone signing in. In some cases, Microsoft says, they went from first target to administrator access in under three hours.
Microsoft says most of the attempts failed, and that this was not caused by a flaw in its own products. ConnectWise's CEO said the company has contained the problem and is restoring service in phases, but that "those actions do not remove unauthorized access that may have already been established." Customers have to check their own accounts.
What it means for operators: the attackers didn't break down the front door. They came in through a tool the customer had already trusted. Every app you connect to your email — backup, scheduling, invoicing — holds a key. If an IT company manages your email, this is the kind of week they should be bringing up with you, not the other way around. (Same door we flagged when one click could open a Copilot inbox.)
Story 4: Anthropic launched an assistant that chases your unpaid invoices
Also on Wednesday, Anthropic, the company behind Claude, released Claude Duet. It's an assistant that works in the background instead of waiting for you to ask. It connects to apps like Gmail, Google Calendar, Slack, and Stripe, sends you a short brief each morning, and checks in every few hours when something needs your attention.
The examples Anthropic gives: finding unpaid invoices and drafting the reminders, preparing payroll for you to review, and getting contracts ready to send. MacRumors reports it's built for professionals and small business owners with too much to track.
It asks for your approval before it sends a message, makes a payment, signs a document, or deletes a file. Anthropic says it doesn't see your passwords. It also admits the assistant can misread a thread or misjudge what's urgent.
For now, it's a waitlist preview for paying Claude subscribers in the US, on the web and iPhone. It uses your existing plan's limits, and its background checks count toward them.
What it means for operators: this is the other side of the first three stories. An AI agent with access to your accounts, working for you. The same question applies: what is it allowed to touch without asking? Anthropic's answer is that anything involving money, messages, or signatures waits for you. That's the right line to expect from any assistant like this. It's a preview with a waitlist, so it's worth watching, not planning around. If you want the draft without handing over the inbox, the overdue-invoice prompt still does that job in a normal chat.
Putting it together
This week, AI made breaking in cheaper and faster. Software ran attacks around the clock for about $50 a success, found holes in the code behind most websites, and reached business email through tools the businesses had already trusted. In the same week, the first assistants built to run your admin started asking for the keys.
The weak spot is rarely the thing you look at every day. It's the thing connected to it that nobody has checked in a year.
None of this means you need a security team. It means knowing three things: who keeps your website updated, which apps can reach your email, and what any AI assistant you invite in can do without asking.
— Aristotle Taylor, CEO & Co-Founder, Levron Labs
What to do this week
Text whoever runs your website one question: "Did our site get the PHP update that came out Wednesday?" If the answer is "What update?", that's your answer.
Then write down every app that can reach your email. If you can't say what each one is allowed to do, that list is the next thing to shrink. Last week's lesson still holds: a backup you have never restored is a hope, not a plan.
Not sure which tools can change customer records or send messages without you? Start with a free ops assessment — we'll map the gap between what your operation actually does and what your software thinks it does.
Sources
AI agents break into 100+ websites (Oct 19)
- Honolulu Star-Advertiser, via Reuters — the campaign, cost, victims, and company responses
- The Next Web — NorForge's findings and the control panel detail
PHP2Shell (Oct 21)
- Wiz — the flaws, affected versions, the WordPress demonstration, and AI's role
- Amazon Web Services Security Blog — the attempt four days before disclosure
- Cybernews — the WordPress risk, PHP's share of websites, and fixed versions
ConnectWise and Storm-0940 (Oct 21)
- Microsoft Security Blog — the ARTEX campaign and timing
- WHTC, via Reuters — the breach and the ConnectWise CEO's statement
Claude Duet (Oct 21)