For most of the history of small business, your best security control was being boring. Attacks cost money: a skilled attacker's time ran hundreds of dollars an hour, so they spent it on targets worth the spend. "Nobody would bother with us" was never really a strategy, but as a risk calculation it mostly held.
That calculation just broke. In October 2026, security firm Gambit Security published an interim report on a campaign they reconstructed from the attacker's own staging server: one operator, using three open-source AI agent frameworks, autonomously attacking hundreds of online retailers — at a marginal cost their own logs put at $25.46 per company, ranging from $3.13 to $79.31.
Twenty-five dollars. The price of a delivered pizza, to attack a business — with the patience, persistence, and creativity of software that never gets bored. The whole campaign's model spend was estimated at $12,000–$18,000 over roughly seven weeks.
What actually happened
The facts, from Gambit's interim report (which security newsletters including Metacurity picked up):
- Three open-source AI harnesses ran nearly the entire attack chain: one searched for vulnerabilities, one executed exploits end-to-end, one orchestrated the campaign and gave tactical guidance. The orchestrator ran with 121 skills installed, 78 of them attack skills.
- Between September 10–15 alone, 105 attack projects launched. At least 27 companies were compromised to varying degrees. The activity traces back to July 2026 and was still running at publication.
- The recoverable impact: at least 600,000 unexpired card details from two companies, card-skimming scripts injected into the websites of five, and some level of access at organizations including a Fortune 500 hospitality company and a major US airline.
- Where access was achieved, it usually took less than a day — in many cases, hours.
- The human's role? About 1,951 short prompts across 260 sessions. A few lines per target. In Chinese, roughly: "read the vulnerability report and start." "Dig deeper into the API." "Goal oriented — shell or backend access."
Two details deserve a slow read.
The models refused. The report notes the attacker's agent switched to an older Anthropic model after newer models refused its requests, and the operator even installed a skill whose sole purpose was stripping the agent's own safety filters. Frontier models are getting harder to weaponize — and this is what the workaround looks like. Hardened defaults have real value; they are not a wall.
The targets were ordinary. Yes, an airline and a Fortune 500 appear in the report. But the volume — tens of companies a day, hundreds total — was ordinary e-commerce sites. Small retailers running common platforms, with file uploads, plugins, and admin panels facing the internet. The same stack your business probably runs.
Why the economics matter more than the drama
Cybersecurity coverage loves the "AI went rogue" framing. The real story is colder: this is an economics shift.
Every security decision a small business makes is implicitly priced. You buy the lock you believe matches the threat. When an attack cost thousands of dollars in skilled labor, mid-sized businesses were priced out of the threat model — attacks on you were irrational, so most never came. When the marginal cost of attacking you is $25 and the loop runs unattended, attacking everyone becomes rational, because attacking everyone is now affordable.
Volume attacks stop being about who you are and become about what you expose. The targeting isn't personal. It's a cost-per-company spreadsheet — and your company is one of the rows whether you knew you were playing or not.
Kaspersky published guidance the same month, applying its "Cyber Immunity" principles to AI agents — treat language models as untrusted components, design security assumptions at the start, isolate, grant minimal privileges. Good advice for builders. But most small businesses don't build AI agents. They run a website, a booking system, a payments plugin. Your defense isn't architectural — it's five boring decisions.
The five decisions that made these targets cheap
Working backwards from the campaign — what made a $25 attack succeed — here's what to fix, in order:
1. Your exposed surface. The attacker's playbook references file uploads, web backends, and WordPress-derived entry points. If your site runs plugins you haven't updated since install, or an admin panel on a guessable URL with no lockout policy, that's the $3.13 end of the range. Update everything, delete what you don't use, and put anything administrative behind MFA — not "a strong password."
2. Where payment data lives. The 600,000 cards were pulled from two companies. Card data sitting on your web server is a vault built into the burglar's entry hall. Use a payment processor that keeps card data on their infrastructure (Stripe, Square, PayPal), never store or log card numbers yourself, and audit your checkout for stray form captures. If you're on an e-commerce platform, check what it logs.
3. Whether anyone is watching. The campaign ran from July and was caught by a security firm's intelligence work, not by the victims. Several targets had live skimming scripts still running when Gambit verified them. Something that alerts you within hours — a file-integrity monitor on your site, an email alert on new admin accounts, a nightly check for unexpected outbound traffic — turns a month-long silent breach into a bad afternoon.
4. How far access travels. One credential shouldn't own everything. The plugin that runs your contact form doesn't need database write access to orders. Your social media manager doesn't need your domain registrar login. When the blast radius of any single compromise is small, the $25 attack stops paying — the attacker spends $25 and gets one small, well-isolated thing.
5. Whether you can recover. The Gambit report notes the attacker's playbook included data deletion and cleanup procedures — and that some victims suffered operational disruption from exactly that. Ransomware taught this lesson; AI attacks inherit it. Backups exist to be tested, not admired. Restore one this month, timed. A business that restores in a day and loses a week of data is a different business than the one that never checks.
The uncomfortable mirror
One more thing worth sitting with: the attacker's orchestrator — the framework with persistent memory, self-written skills, scheduled jobs — is the same class of software that small businesses are being told to adopt this year. The exact properties that make an agent useful (it runs unattended, it retries, it plans around obstacles) are what industrialized this attack. That's not an argument against agents. It's the reason the boring checklist above isn't optional anymore — the technology wave raised the stakes on both sides of the door at once.
The report's own recommendation is the right one, and it's the same one for a five-person shop as for an airline: shift to a resilience-first posture. You will not perfectly prevent every $25 attack. You can make each one cheap for you and expensive for them.
One honest note on who's writing this: we're a $0-revenue small team running a public 14-day experiment on whether our playbook advice actually works — the receipts are here. The playbook covers the agent-permission side of this — the access ladder, the approval gates, the audit habit — in The AI Agent Owner's Playbook, $49 CAD, instant download.
Top comments (0)