Starting on Sept. 25, a hacker set loose an army of AI agents that attempted to break into over 1,200 websites over the following few weeks—autonomously, with no additional work required of the human hacker after sending them off on their task.

The agents successfully breached about 100 companies, including farm equipment maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins, according to Reuters, which first reported the incident, discovered by cybersecurity researchers.

While the hacker didn’t need to execute the attack themselves, they had to foot the bill for the AI tools. It cost about $5,000 worth of tokens from a combination of DeepSeek and Anthropic’s Claude Code models, researchers told Reuters. That’s roughly $50 per successful breach.

Autonomous attacks powered by AI agents are becoming more common, Jessica Ji, a senior research analyst at Georgetown’s Center for Security and Emerging Technology (CSET), told Fortune. This is primarily happening because the tools have “gotten meaningfully better” over the past year or so, she said. Specifically, AI companies have improved their models’ coding skills, which has led to a “dramatic increase in their ability to do cybersecurity-relevant tasks like analyze large volumes of code,” she said. Also, they have become more agentic, meaning they can use other software to complete tasks, as opposed to merely outputting text.

“These AI systems are now both more capable of hacking and are able to act more autonomously,” Ji said.

Agents powered by large language models (LLMs) can run all day and night without stopping, at a “fraction of the cost of human attackers,” Varun Chandrasekaran, assistant professor of electrical and computer engineering at the University of Illinois’s Grainger College of Engineering, told Fortune. This “fundamentally changes the economics of exploitation,” he said, citing the attackers who spent only $50 per successful reach.

Debate grows over the value and risks of open-weight AI

Open-weight models, or those that are publicly downloadable and customizable, can also offer powerful, low-cost tools for agentic hacks, Ji said. Attackers are “not restricted to the most capable ‘closed’ models and can use similarly capable open models that are potentially more difficult to set up, but less expensive,” she said.

The wide availability of low-cost, powerful open models is one reason Anthropic CEO Dario Amodei has warned that open models in particular pose a risk of widespread and potentially devastating cyberattacks. It is one reason that Amodei and others have said that there may need to be government restrictions placed on the distribution and use of open models.

However, others disagree and say open models benefit defenders more than attackers. For example, when AI company Hugging Face discovered it was being autonomously attacked by an agent in July, it first tried to use a closed model to defend itself, but the model refused the request owing to its security guardrails. Hugging Face then switched to an open model, GLM 5.2, made by China-based Z.ai, which it used to help fend off the attack.

More autonomous cyberattacks

The same thing happened during another agentic attack this week that targeted OpenCode, an AI-powered coding platform. A hacker unleashed an autonomous AI model on OpenCode that was “nonstop trying to attack our systems for the past 48 hours,” OpenCode cofounder Dax Raad posted on X on Oct. 18. The attackers broke into certain OpenCode user accounts, affecting 1.4% of its users, according to the company. It spent their money, with some people losing as much as $1,700, Dealroom reported.

The company fought back with its own AI agents, which it kept running “24/7,” according to Raad. OpenCode had been running its defense with an OpenAI model, which started to refuse its requests in the middle of the attack. This was “a bit frustrating,” Raad said. But the company was able to continue after asking OpenAI to admit it to the company’s Daybreak Blue, an application-only program that allows verified cybersecurity professionals to use its most advanced tools.

After some mild online backlash to OpenAI’s models initially refusing OpenCode’s requests, OpenAI executive Dean Ball said this was required to prevent bad actors from using its models for “sustained autonomous cyberattacks.” In what appears to be a first, OpenAI refunded OpenCode users who lost money in the attack, OpenAI’s head of core products, Thibault Sottiaux, said on X.

In a third agentic attack this month—the most severe one—bad actors hacked into several South Korean banks. The attackers were likely based in China, according to Reuters, and used a combination of a Chinese state–developed AI tool called Artex, built on open models, as well as Anthropic’s Claude Code. They stole data from an estimated 68,000 people, the Wall Street Journal reported.

South Korean officials urged banks to harden their defenses. “Cybersecurity attacks powered by AI agents have been increasing in South Korea, and I expect they will grow in number worldwide in the future,” Mun Chong-hyun, who heads Genians Security Center, a Seoul cybersecurity analytics firm, told the Journal.