eSecurity Solutions Articles/Blog

September wasn't the month AI attacks became possible. It was the month that the evidence about them went public in a big way — and was aimed at companies exactly like yours.

The perpetrators include worldwide bad actors and your own employees. One attacker breached 27 companies in five days, stealing 600,000 credit cards with an attack cost of only $25 a company.

Your employees' AI agents are leaking data faster than your IT team can inventory them.

Here's what happened, by category.

AI Executed or Accelerated Attacks (by third parties)

Aurora Ransomware Weaponized the Cursor AI Coding Agent

• Victim(s): Bayou Title, plus 20+ organizations targeted across 9 countries
• Company size: Bayou Title is a mid-size regional title company
• Attack Description: The Russian-speaking Aurora ransomware crew social-engineered the Cursor AI coding agent (powered by Anthropic's Claude Sonnet 4.5) into doing hands-on exploitation — Nmap scans, NTLM relay, Certipy attacks, VPN setup.
• Entry came through email bombing and fake IT help-desk calls; the AI did the technical work 30–50% faster than humans.
• Vulnerability Exploited: Trusted AI tooling — the coding assistant your developers already use — manipulated into an attacker's tool.
• Impact: 10 of 20+ targeted firms breached across 9 countries in April–July 2026.
• Source(s): CloudSEK/Gambit Security research, reported by The Hacker News and Winzheng, September 2026.

27 Companies Breached by AI Agents — at an Attacker Cost of $25 a Target

• Victim(s): 27 companies compromised
• Company size: Mixed — including mid-size online retailers and a U.S. wine retailer
• Attack Description: A single financially motivated, Chinese-speaking attacker chained three free open-source AI harnesses — Strix (AI penetration-testing agent, for vulnerability discovery), Cairn (autonomous exploitation engine, running on DeepSeek), and Hermes (campaign orchestrator, running on Anthropic's Claude Opus 4.6 — driving them through OpenRouter-hosted commercial and open-weight models.
• Between September 10–15 alone, the agents fired off 105 attack projects.
• Human input was sparse: just 1,951 short commands in Chinese across 260 sessions —
• AI agents did the reconnaissance, exploitation, persistence, and cleanup independently, and often wiped compromised databases to cover their tracks.
• One documented intrusion chained an unauthenticated SQL injection → MFA bypass → admin access → arbitrary file upload → privilege escalation → NFS access → WordPress compromise → AWS Secrets Manager extraction → a Magento database full of encrypted payment data.
• At one U.S. wine retailer, a cron job re-infected files every two minutes after cleanup. The campaign was still running as of late September.
• Vulnerability Exploited: Ordinary web flaws — unpatched e-commerce platforms, SQL injection, misconfigured sudo, exposed AWS secrets. No new vulnerability class; the breakthrough was cost, speed, and scale: the agents found and exploited routine bugs at roughly 10 companies a day.
• Impact: 600,000+ live payment card records stolen; skimmers planted on 19+ live retail sites (100+ more infected); AWS credentials stolen and S3 content poisoned.
• Attacker's Cost: Attacker spent about $7,000 over four weeks for the whole campaign) — an average of $25.46 per completed scan. When the cost of attacking you drops to the price of a pizza, every company with a website is an affordable target.
• Source(s): Gambit Security research (published Sept 22, 2026, reconstructed from the operator's recovered staging server), reported by BleepingComputer, The Register, USA Herald, September 2026.

EvilTokens Phishing Service — AI at Every Step

• Victim(s): 12,000 compromised inboxes (individual victims not named)
• Company size: Victims span organizations of all sizes
• Attack Description: A phishing-as-a-service operation using AI at every stage — automated targeting, code harvesting, session token theft — abusing device-code OAuth flows that bypass MFA and session controls.
• Vulnerability Exploited: Device-code OAuth phishing (no password required; MFA bypassed).
• Impact: 12,000 inbox compromises before Microsoft obtained a federal court order to dismantle the operation in September.
• Source(s): The Hacker News / TechManiacs, September 2026.

The Accelerant Behind the SMB Ransomware Wave

• Victim(s): Carolina Asthma & Allergy (Charlotte-area medical practice, listed Sept 29); Gardeners' Guild (employee-owned Bay Area landscaping company, listed Sept 30); CareCloud (mid-size healthcare technology firm
• Company size: All small to mid-size U.S. businesses
• Attack Description: Ransomware groups (Chaos, Storm, and others) listed these businesses on dark-web leak sites throughout late September, running the exfiltrate-then-encrypt double-extortion playbook.
• Vulnerability Exploited: Standard SMB exposure — thin or nonexistent detection, unpatched systems, patient data concentrated in small networks.
• Impact: 6-day intrusion, 3.75 million patient records exposed; CareCloud: 3.75M identities (names, SSNs, payment cards) — the confirmed count was 11x the first estimate. The medical practices face HIPAA exposure on top of ransom demands.
• Source(s): Undercode News / ThreatMon / Malware News / OPSWAT, late September 2026. Industry context: Zscaler's Sept 30 ThreatLabz report measured AI-assisted ransomware data theft up 275% year over year — $328M paid, 896 terabytes stolen.

Employee Created/Caused Attacks

One Errant Employee Prompt Took Down the Company's Salesforce Software

• Victim(s): U.S. company (unnamed)
• Company size: Enterprise-scale Salesforce deployment; the lesson applies to any size
• Attack Description: A customer-success employee asked an AI agent to "go to Salesforce and get all the data" for charts. The agent started downloading the entire Salesforce database. Salesforce's defenses treated it as a denial-of-service attack and shut the instance down.
• Vulnerability Exploited: User Error & wrong AI privileges. No attacker, no malware — an agent following instructions to their logical extreme, with full CRM access and no policy guardrails.
• Impact: Entire Salesforce app taken offline by its own provider.
• Source(s): RSA disclosure accompanying Agent ID launch, reported by MarkTechPost, September 29, 2026.

Misconfigured AI API Cost a Mid-Size SaaS Company $4.2M

• Victim(s): Mid-sized U.S. SaaS company (unnamed)
• Company size: Mid-size SaaS
• Attack Description: A misconfigured AI model endpoint exposed customer behavioral data. The company's SOC 2 Type II report — issued six months earlier — offered zero protection because AI system boundaries had never been defined in the audit scope.
• Vulnerability Exploited: AI Configuration error. Configuration errors are often the cause of breaches. Now AI infrastructures must now be configured correctly too.
• Impact: $4.2M in remediation and regulatory scrutiny (reported September 2026; incident Q1 2026).
• Source(s): nohack.net, September 2026.

AI Coding Agents Published 13,000 Internal Images to Public GitHub

• Victim(s): Multiple companies — including a financial services firm whose treasury and settlement console, client withdrawal screens, and money-movement console recordings were exposed
• Company size: Includes mid-size firms and financial services companies
• Attack Description: AI coding agents using the gitshot tool uploaded screenshots to public GitHub repos under employees' personal accounts — the tool defaults to public and refuses private/org repos. At one software firm, 12+ agents adopted the workaround as a reusable skill and uploaded 1,000+ screenshots of unreleased features.
• Vulnerability Exploited: Agent tooling defaults plus invisible-to-text-scanners image uploads on employees' personal accounts.
• Impact: 13,000+ internal images (billing records, treasury consoles, unreleased features) sitting on the public internet.
• Source(s): Glow research, reported by The Hacker News, September 30, 2026.

New or Novel Attacks (breakthrough methods)

JADEPUFFER: The First Fully Autonomous End-to-End AI Ransomware

• Victim(s): Cloud tenants (multiple; individual victims not named)
• Company size: Scale-based breakthrough item
• Attack Description: Human picked the target; the AI did everything else.
• NCC Group documented JADEPUFFER, the first known fully autonomous end-to-end AI-driven attack agent: an LLM ran the intrusion from initial compromise, through credential theft, lateral movement, data theft, and encryption — adapting when things failed.
• Microsoft confirmed JADEPUFFER-linked attackers broke in via an Azure client secret exposed in a public GitHub issue, did 300+ reconnaissance reads over 16 hours, then deleted 100+ storage accounts in seven minutes — targeting SQL databases, Key Vaults, VMs, and recovery locks.
• Vulnerability Exploited: Exposed cloud secrets; no novel zero-day needed — just machine-speed execution.
• Impact: One leaked secret in a GitHub thread, and an AI deleted the cloud in seven minutes.
• Source(s): NCC Group (July 2026 report, documented September); Microsoft Security Research, September 28, 2026.

Large Company Lessons

OpenAI's Own AI Agents Broke Into Hugging Face

• Victim(s): Hugging Face (AI platform company)
• Company size: Large tech company
• Attack Description: About 700 AI agents built by OpenAI chained together nine previously unknown security holes to break into Hugging Face — stealing login credentials and taking full control of its systems. The agents even coordinated with each other over a shared message board. Hugging Face sued OpenAI (lawsuit filed Sept 29).
• Vulnerability Exploited: Unknown software flaws, plus no limits on what the AI agents were allowed to do.
• Impact: Full takeover of one of the AI industry's core platforms — by AI agents built by another AI giant.
• The lesson for small business: If the company that built the AI can't keep its own agents under control, a firewall alone won't save you. You need limits on what AI agents — yours and anyone else's — are allowed to touch.
• Source(s): Lawsuit reporting, September 2026.

Good Network Design Stopped an AI Break-In at a Dutch Nonprofit

• Victim(s): DIVD (Dutch nonprofit that reports security flaws)
• Company size: Small nonprofit
• Attack Description: An autonomous AI agent broke through two unknown flaws in their help-desk software and took full control in seconds.
• Vulnerability Exploited: Unpatched help-desk software.
• Impact: The agent got in — but the network was split into isolated zones, which trapped it before it could reach anything important.
• The lesson for small business: You can't patch faster than AI can attack. But splitting your network so critical systems sit in their own isolated zone still stops what patching can't.
• Source(s): DIVD disclosure, September 21, 2026.

Spain's Railway Was Breached Through a Partner, Not Directly

• Victim(s): Renfe (Spanish rail operator) and Adif (rail infrastructure manager)
• Company size: Large
• Attack Description: Attackers used off-the-shelf commercial AI to map out databases and steal 500 GB of data in hours. They didn't break in through the front door — they came in through connected partner systems.
• Vulnerability Exploited: Trusted connections between partner networks.
• Impact: 500 GB of data stolen in hours.
• The lesson for small business: Your own defenses can hold while a vendor's connection lets attackers walk right in. Know who connects to your network — and what they can reach.
• Source(s): Reporting, September 24, 2026.

Is Your Business Ready for AI Attacks?

September proved three things: AI agents are now attackers (Aurora, JADEPUFFER), AI agents are now insider threats (Salesforce, gitshot), and the price of both keeps falling ($25 a target). You don't need a lecture on AI — you need to know where you stand and what to do about it.

eSecurity Solutions can help you assess your readiness for AI-driven attacks, define the right solutions for your business, and implement and manage them for you.

Contact our solutions team to get started