Hackers are now using AI agents to run many attacks at once, and these AI agent attacks are getting cheaper to scale. On October 29, 2026, CrowdStrike reported a campaign in which a single AI agent framework was used against more than 200 organisations worldwide in 11 days, with a human operator stepping in only at key decisions. The targets in that case were governments and large companies, but the lesson applies to small businesses too: attacks are getting faster and cheaper to scale.
This guide explains what happened in plain English, what it means for small businesses, and a practical security checklist you can work through this week. The incident details come from CrowdStrike's own report.
QUICK ANSWER
On October 29, 2026, CrowdStrike reported that one AI agent framework was used against more than 200 organisations in 11 days, with a human stepping in only at key decisions. Attacks are getting faster and cheaper to scale, so small businesses should turn on multi-factor authentication, change old passwords and update everything this week.
What happened: AI agents running attacks
According to CrowdStrike's report, a China-nexus group it tracks as VAPOR PANDA used an AI agent framework called ARTEX, mainly powered by the DeepSeek language model plus a second commercial model. Key facts from the report:
- Starting October 17, 2026, the framework was used against more than 200 organisations in at least 14 countries over an 11-day window.
- CrowdStrike confirmed follow-on activity at nine organisations, and password-spraying against at least 12 more.
- A human operator gave instructions at decision points while the agents worked in parallel.
- In one intrusion alone, the planning agents used on the order of 1.4 billion input tokens.
CrowdStrike's assessment is that such groups will "highly likely" keep adopting agent frameworks over the next 12 months, letting small teams attack many targets at once.
Why this matters for small businesses
The attackers in this report went after ministries, telecoms and big companies. But look at how they got in, because none of it was exotic:
- Old, leaked credentials: in one case, keys from a 2022 data export that had likely never been rotated.
- VPN details found in old emails and a key from a past email leak.
- Password spraying: trying common passwords across many accounts.
- Unpatched web apps and misconfigured cloud services.
- Computers without security software: the operator told the agents to look for machines without endpoint protection.
AI agents make it cheap to try these basic tricks against thousands of targets. Small businesses, which often have weak passwords and no IT team, are easy wins when attacks are automated.
Small business security checklist for the AI era
1. Turn on multi-factor authentication everywhere
Email, banking, social media, accounting and your website admin. Password spraying fails when a password alone isn't enough. App-based codes or security keys are stronger than SMS.
2. Use a password manager
Give every account a long, unique password. Reused passwords from old leaks are exactly what automated attacks try first.
3. Rotate old keys and passwords
CrowdStrike's first recommendation is to rotate signing keys and credentials after any suspected exposure, "including keys contained in historical backups". For a small business, that means changing passwords for former staff, old shared logins and anything that has ever been in a leak.
4. Clean up your inbox
Don't keep VPN files, passwords or bank details sitting in email. In the report, attackers pulled VPN configurations from a user's sent mail.
5. Update everything
Turn on automatic updates for computers, phones, routers, website plugins and themes. CrowdStrike specifically advises patching internet-facing devices and long-lived servers.
6. Install security software on every device
The attackers looked for unprotected machines. Make sure every work computer has up-to-date protection, including the old PC in the back office.
7. Keep offline backups
Back up important files and keep one copy disconnected from your network, so an attack can't encrypt or delete it.
8. Give AI tools the least access possible
If you use AI assistants or agents for your business, don't hand them your main email password or full bank access. Start with read-only tasks and keep a human approving payments. New models like GPT-6 are increasingly able to act on your behalf, which is useful, but access should be limited.
9. Train your team on scam messages
AI makes phishing messages more convincing. Agree on one rule: any request for money, passwords or codes gets verified by phone using a known number.
Using AI to defend your business
AI isn't only a threat. You can use an assistant to explain a suspicious email, draft a simple security policy for staff, or make a checklist for new employees. Our ChatGPT vs Gemini vs Claude comparison covers which assistants suit small businesses. Just never paste real passwords, customer data or bank details into a chatbot.
A 30-minute security plan for this week
You don't need a big budget to start. If you only have half an hour, do these in order:
- 10 minutes: turn on multi-factor authentication for your main business email. If email falls, attackers can reset almost every other password.
- 5 minutes: do the same for your bank and payment apps.
- 5 minutes: remove accounts and access for anyone who no longer works with you.
- 5 minutes: check that automatic updates are on for your main computers and phones.
- 5 minutes: search your inbox for words like "password" and "VPN", and delete or secure anything sensitive.
Then put a monthly reminder in your calendar to review accounts, backups and updates. Small, regular habits beat one big clean-up that never gets repeated.
What to do if you think you've been hacked
- Disconnect the affected device from the internet.
- Change passwords from a clean device, starting with email.
- Turn on MFA if it wasn't already on.
- Tell your bank if payment details may be exposed.
- Get help from a trusted IT professional, and report it to your national cybercrime authority.
Want to put this into practice? Try our free Password Generator and QR Code Generator right in your browser, then read Claude Code Extension Backdoor and Claude Haiku 5.5 for Small Business on Botvana.
Related: Need better passwords for your team? Try our strong password ideas you can actually remember. Printing QR codes for your shop? Read how to make a QR code for free, including the safety tips.
FAQ
What is an AI agent attack?
An attack where AI agents carry out steps like scanning, trying passwords and moving through networks automatically, often with a human guiding key decisions.
Are small businesses targeted by AI agents?
The CrowdStrike case targeted large organisations, but the methods used, like leaked passwords and unpatched software, work against anyone, and automation makes it cheap to hit many targets.
What is the most important security step for a small business?
Multi-factor authentication on email and financial accounts, together with unique passwords.
Is it safe to use AI tools in my business?
Yes, with care: limit access, keep humans approving money and sensitive actions, and don't paste secrets into chatbots.
What is ARTEX?
An AI agent framework that CrowdStrike says was used in the VAPOR PANDA campaign to run parallel intrusions.
Sources and further reading
- This Week in AI: Agents Rewrite the Rules (O'Reilly Radar)
Comments
Post a Comment