01 / The shift
Cheap attacks. Expensive mistakes.
AI agents are becoming superhuman at specific security tasks. The UK NCSC reports that frontier models outperform skilled practitioners on some tasks at lower cost. Attackers can use swarms to find weaknesses, discover zero-days, and develop exploits.
In one controlled test, an AI model turned two known browser flaws into a working exploit chain for an estimated $20.40 in model costs.
Our conclusion: your business no longer needs to interest a nation state to face sophisticated attacks. One mistake can mean stolen customer data, extortion, or disruption.
Defense takes dedicated specialists, continuous testing and monitoring, and rapid adoption of new security practices. Choose a provider investing in that work. Octocom does, every day.
02 / The evidence
This is already happening.
AI-driven intrusions have reached production systems, exposed business data, and crossed government access controls. These are incidents organizations have already had to investigate and contain.
July 2026
Stolen credentials. Internal systems accessed.
Hugging Face disclosed an intrusion in which AI agents carried out more than 17,000 actions, stole credentials, and moved across internal systems. Its defenders also used AI to detect and investigate the attack.
The disclosure reported access to internal datasets and credentials. Assessment of any partner or customer-data impact was still underway.
Reported September 2026
One SaaS breach. Around 200 organizations’ data stolen.
Anthropic documented attackers breaching a SaaS provider and extracting data belonging to roughly 200 of its customer organizations. Its report says AI agents performed nearly all the work.
The provider was not named. The case shows why a vendor’s security operation matters: a SaaS subscription alone is no guarantee.
June 2026 / disclosed September
An AI agent accessed non-public government files.
Australia’s Prime Minister said an OpenAI agent gained unauthorized access to the Medicare statistics portal, accessing public and non-public files after finding ways around blocks.
This was an agent exceeding a research task. The September statement reported no evidence of personal-information access or wider Services Australia compromise.
The incentives are commercial. In August 2025, Anthropic reported disrupting AI-assisted data theft and extortion targeting at least 17 organizations, with demands sometimes exceeding $500,000.
Defensive research tells the same story about what AI can find: a 27-year-old flaw in OpenBSD that could crash a host remotely, and 271 Firefox vulnerabilities fixed after Mozilla’s early Mythos evaluation. These were discoveries followed by patches, rather than the business intrusions above.
03 / Your responsibility
Who gets the call at 2 a.m.?
A support agent may read orders, access CRM records, or issue refunds through Shopify and Stripe. If your DIY agent is compromised, an attacker can abuse the access you granted it, even when those platforms remain secure.
- Application security
- Software flaws, stolen integration credentials, or weak access controls can expose the data and actions your integration permits.
- Agent security
- Prompt injection or jailbreaks can redirect an agent into leaking accessible data or taking unauthorized actions, even when the underlying software is patched.
“Actually it is not recommended to use vibe coding for complex functions, business critical programs, or programs that are used for a long time.”
OWASP is addressing code written and committed with little human oversight. Its guidance calls for developers to understand, review, and secure the code they ship.
One busy IT generalist, or a non-technical colleague using a vibe-coding tool, cannot be expected to become a security department simply because they built the app.
- 01
Who looks before an attacker does?
Dedicated security expertise, code review, penetration testing, and a process for fixing what they find.
- 02
Who notices an intrusion?
Monitoring, useful logs, alerts that reach a responsible person, and someone available to investigate.
- 03
Who can contain it immediately?
A practiced way to revoke access, isolate affected systems, and stop sensitive actions.
- 04
Who gets the business safely running again?
Tested recovery plans, an incident lead, and clear processes for assessing impact and communicating with customers.
“Currently, there are risks that are likely far outside most organisations' risk tolerances.”
On replacing SaaS with vibe-coded software, March 2026.
If the answers are unclear, the security work is still yours. So are the disruption, the customer conversations, and the exposure when data is stolen or used for extortion.
The US NIST’s demonstrated AI-assisted development workflow includes human review, security validation, automated tests, and approval gates. Those are operating responsibilities you need to staff and maintain.
04 / The decision
Any software can be targeted. Is your organization prepared?
This goes beyond AI helpdesks. A CRM, customer portal, or internal tool can be attacked whether it uses AI or not. Every system needs an organization prepared to defend it.
“For internet-facing services, consider using software-as-a-service cloud services that are rapidly patched by reputable cloud service providers.”
Guidance for medium-sized businesses facing AI-enabled cyber attacks, July 2026.
Where a reputable SaaS product fits, choose one backed by dedicated security expertise and established response processes. If you build instead, budget for those responsibilities for the lifetime of the software.
Your business still manages its users, access, integrations, and configuration. A specialist SaaS provider operates and secures the platform alongside those responsibilities.