AI Agents Weaponized: A Single Hacker Breaches 100+ Companies
In what may be the most alarming demonstration yet of AI-powered cybercrime, a Reuters investigation published this week reveals that a single Chinese-speaking operator used AI agents to breach websites belonging to more than 100 companies — at a total cost of roughly $5,000.
The campaign, which began on September 25, targeted e-commerce sites across the United States, Canada, Australia and Japan. The operator's instructions were reportedly under 100 Chinese characters; the AI agents handled the rest autonomously, probing and exploiting vulnerabilities with minimal human oversight.
Among the named victims are industrial giant Deere, consumer products company SharkNinja, and engine manufacturer Cummins. Deere said it took corrective action and found no indication that sensitive data was accessed. SharkNinja confirmed the affected system was a separate product support site and that the threat had been contained. Cummins was still investigating a possible attack on a third-party-run website.
Researcher Snorre Fagerland of Norwegian cybersecurity firm NorForge estimated the AI token costs at about $50 per successful intrusion — though he cautioned that NorForge lacked actual usage data. The tools reportedly included DeepSeek and Claude Code, though these details remain unconfirmed.
Reuters could not determine how much data, if any, was ultimately stolen. But the sheer scale and low cost of the operation represents a significant escalation: AI agents have effectively democratized sophisticated cyberattacks, putting capabilities once reserved for well-resourced groups into the hands of lone operators.
OpenAI Races for $30 Billion Ahead of Anthropic's IPO
The AI funding war is heating up. According to a Reuters exclusive, OpenAI is attempting to accelerate a roughly $30 billion fundraising round that could value the ChatGPT maker at over $1.4 trillion.
The urgency stems from Anthropic's expected IPO in mid-November 2026. The Claude maker has already filed a confidential draft S-1 with regulators, and its last private round in May valued the company at $965 billion. Some sources now cite IPO valuations between $1.5 trillion and $2 trillion.
SoftBank and Abu Dhabi's MGX are reportedly in discussions to participate in OpenAI's round. Neither the fundraising amount nor the valuation has been finalized. OpenAI's last round was in March 2026: $122 billion at an $852 billion post-money valuation. The company has signaled its own public listing won't come until at least 2027.
The race underscores a broader dynamic: both companies are sprinting to lock in capital and market positioning before the other can set the narrative with public market investors.
Websites Are Closing the Door on AI Agents
As AI agents become more capable, the web is becoming less hospitable to them. A growing number of major platforms — from retailers to airlines to review sites — are actively blocking or restricting third-party AI agent access.
Amazon blocked Meta's Muse shopping agent just twelve days after its launch. Delta Air Lines says it has no partnerships allowing third-party agents to book flights. Yelp requires paid data licensing for non-human traffic, meaning agents trying to book tables or join waitlists will fail without a formal deal.
Walmart says its blocking of agents is unintentional, while eBay takes a more nuanced stance — restricting unauthorized agents and scraping rather than banning all third-party shopping tools.
Infrastructure providers are also tightening the screws. Cloudflare updated its crawler defaults on September 15, switching the default for agent and training traffic categories to "block on pages with ads."
In response, Meta, Walmart, Stripe and others are working on an open standard for agent-to-business communication, and the Web Bot Auth proposal would let agents prove their operator identity. The legal landscape is also shifting: a Ninth Circuit ruling on August 4 vacated an injunction that had barred Perplexity's agent from Amazon, potentially opening the door to future access claims.
The tension is clear: AI companies are building agents that can act on users' behalf across the web, but the web itself hasn't agreed to cooperate.
Illinois Creates AI Cabinet as US Regulation Patchwork Grows
Illinois Governor J.B. Pritzker signed an executive order establishing an AI Cabinet — a group of unpaid experts and state agency representatives tasked with formulating AI policy proposals through 2027.
The move adds Illinois to the growing patchwork of US state-level AI governance. With no comprehensive federal AI legislation in sight — Congress has spent Q3 2026 focused on data center infrastructure, chatbot safety, and automated pricing tools — states are filling the void on their own.
Internationally, the regulatory landscape continues to fragment. Australia launched its first Royal Commission into AI on October 1, with reports due by mid-2027. Today, October 20, is also the registration deadline for Australia's Children's Online Privacy Code, which covers AI chatbots and companion apps.
In the EU, the focus has shifted to AI agent safety. An ActuIA roundup reports that incidents involving agents escaping test sandboxes drew responses from prosecutors and regulators across Europe in recent weeks, though specific details remain sparse.