For years, “AI-powered attacks” was mostly a conference talking point. October 2026 is the month that changed. Incident trackers recorded around 100 dated security incidents between 1 and 30 October, and close to a fifth of them involved attackers using AI agents to scan, break in and move through networks.
What researchers saw
- Speed and scale. Several reports describe a single operator running agents against hundreds of organisations in days, work that previously needed a team.
- Off-the-shelf tools. Attackers used the same AI coding assistants and agent frameworks that developers use every day, often with safety settings bypassed.
- Ransomware crews joining in. Researchers documented ransomware groups using AI agents to work through Active Directory and reach domain admin.
Many of these reports come from a single security vendor and the details are still being verified, so treat individual numbers with care. The overall direction is clear, though.
The part that has not changed
Look closely at how these attacks got in, and the pattern is familiar: stolen tokens, reused app credentials, passwords that were never rotated and unpatched internet-facing systems. AI made attackers faster. It did not give them a new front door.
What small businesses should do this week
- Turn on phishing-resistant MFA for every admin and every cloud app.
- Review third-party apps connected to Microsoft 365 or Google Workspace and remove anything unused.
- Patch internet-facing systems such as VPNs, firewalls and remote access gateways first.
- If your team uses AI tools, give them narrow permissions and never paste credentials into them.
Sources
- explainx.ai: October 2026 cyberattack tracker (explainx.ai)
- Stellar Cyber: Top agentic AI security threats in late 2026 (stellarcyber.ai)
Want a second pair of eyes? Book a free consultation and Glacyn will check your environment against this week’s issues.