Critical

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

The Hacker News

October 20, 2026 at 2:07 PM

Actively Exploited

Overview

A security researcher observed a Chinese-speaking hacker group using autonomous AI agents to breach over 1,200 websites belonging to more than 100 companies, including well-known names like Deere. The hackers operated these AI agents with minimal supervision, allowing them to exploit vulnerabilities in the targeted sites. Remarkably, the attackers left their control panels exposed online, which enabled the researcher to witness the activity in real-time. This incident raises serious concerns about the security of corporate websites and the potential for widespread data breaches. Companies must take immediate action to secure their systems and prevent similar attacks in the future.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Websites belonging to over 100 companies, including Deere and various others.
Action Required: Companies should enhance their website security measures, conduct regular vulnerability assessments, and ensure that control panels are not exposed to the internet.
Timeline: Ongoing since recent observations

Original Article Summary

A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company

Impact

Websites belonging to over 100 companies, including Deere and various others.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since recent observations

Remediation

Companies should enhance their website security measures, conduct regular vulnerability assessments, and ensure that control panels are not exposed to the internet.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Vulnerability.

Read Original Article

Related Coverage

Microsoft Teams to get AI-powered, context-aware phishing detection

BleepingComputer

Microsoft is set to enhance its Teams messaging platform with AI-driven phishing detection capabilities starting in early November 2026. This new feature aims to identify and flag potential phishing attempts within Teams messages, helping users avoid falling victim to scams. The integration of AI is expected to improve the accuracy of phishing detection by analyzing the context of messages. This is particularly important as phishing attacks continue to rise, targeting both individuals and organizations. By implementing this technology, Microsoft hopes to bolster security for its users and reduce the risk of data breaches associated with phishing.

Oct 23, 2026

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

The Hacker News

Ruby has released updates to versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in the Onigmo regular expression engine. These bugs are linked to four critical vulnerabilities that GitLab recently patched. The vulnerabilities could allow attackers to craft specific patterns that may corrupt memory during the compilation process, potentially enabling remote code execution on affected servers. This issue is particularly concerning for GitLab users, as it puts their systems at risk if the vulnerabilities are exploited. Users are encouraged to update to the latest Ruby versions to mitigate these risks.

Oct 23, 2026

AI Tools Are Generating Massive Attacks for Little Cost

darkreading

A recent report reveals that attackers are using AI tools to launch large-scale cyberattacks at a very low cost. One notable campaign targeted 105 websites, employing open-weight models to gain unauthorized access. In another instance, attackers managed to gain full control over a domain for merely $12 using publicly available AI models. This shift in tactics suggests that cyber-defense strategies need to evolve rapidly, as the cost-effectiveness of these AI-driven attacks makes them more accessible to a wider range of adversaries. As organizations increasingly rely on digital platforms, they must bolster their security measures against these emerging threats.

Oct 23, 2026

Quest Diagnostics confirms data breach exposed patient records

BleepingComputer

Quest Diagnostics, a major American clinical laboratory, has confirmed a data breach involving unauthorized access to its Quanum LSM system. This breach has led to the exposure of sensitive patient records, although the company has not disclosed the exact number of affected individuals or the specific types of data compromised. The incident raises significant concerns about patient privacy and the security of personal health information. As a trusted provider of medical diagnostics, the breach may undermine patient confidence in Quest's ability to protect their sensitive data. This incident serves as a reminder of the ongoing risks faced by healthcare organizations in safeguarding personal information against cyber threats.

Oct 23, 2026

PHP shares mitigation for new RCE vulnerability with no patch

BleepingComputer

The PHP security team has announced a new remote code execution (RCE) vulnerability affecting systems with non-default configurations. This vulnerability currently has no patch available, which raises concerns for users who may be exposed. It is particularly important for administrators to review their configurations to ensure they are not inadvertently leaving their systems vulnerable. The PHP team has provided mitigation measures to help users protect their systems until a fix can be implemented. This situation underscores the ongoing challenges in maintaining secure software environments, especially when vulnerabilities are discovered without immediate solutions.

Oct 23, 2026

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

SecurityWeek

Recent reports indicate several significant cybersecurity incidents that might not have received widespread attention. Russian hacking group APT28 has targeted NATO defense firms, highlighting ongoing threats to military and governmental cybersecurity. Additionally, source code from the database management platform PingCAP was stolen, raising concerns about potential vulnerabilities in widely used software. Financial institutions have also detected rogue AI agents, which could pose risks to banking security. Lastly, a new form of macOS ransomware has emerged that can rebuild itself, complicating efforts to eliminate it. These incidents collectively underline the evolving tactics used by cybercriminals and the importance of robust security measures for organizations.

Oct 23, 2026