AI Tools Are Generating Massive Attacks for Little Cost

AI tools are fundamentally altering the economics of cyberattacks by significantly reducing both cost and required expertise. A recent five-day campaign in September, attributed to a Chinese-speaking attacker, leveraged three different AI harnesses and both open-weight and public AI models to target 105 e-commerce sites. This operation compromised at least 27 companies, including one Fortune 500 firm, stealing over 600,000 payment card records and installing skimmers, all for an average cost of $25.46 per successful target, Gambit Security reports.

This shift means that tasks previously requiring a coordinated team of skilled attackers can now be executed by a single individual with limited prior knowledge, according to Sa'ar Elias of Gambit Security. This trend is not isolated; agentic AI has accelerated vulnerability research and automated attack execution. In a lab test, Silverfort researchers demonstrated an orchestrating agent with publicly available AI achieving complete domain control in just eight minutes, highlighting how quickly initial access can escalate to a full compromise.

The falling barrier to entry is also reflected in dark market prices, where the average cost of "initial access" – the first successful entry into a system – has dropped from over $1,400 to $429, according to Flashpoint. This decline is attributed to an increased supply driven by AI-powered tools. While fewer companies are paying ransoms, ransomware activity itself grew by 45% in the first half of 2026, indicating that AI makes operations faster and easier to scale across the attack chain.

For defenders, this creates an unsustainable economic challenge. Attackers can launch sophisticated assaults at very low marginal costs using tools like the agentic AI system Hermes and AI penetration-testing frameworks Strix and Cairn. This forces defenders to maintain high reliability across complex environments against a proliferation of cheap, autonomous attacks. Gambit Security's Elias suggests that simply applying AI to existing security processes will be insufficient; companies must identify and protect their most critical business processes to prevent disruption.