Artificial intelligence is no longer changing only how businesses work. It is changing how cybercriminals attack them.

Recent reporting on an AI-assisted campaign against online retailers offers one of the clearest examples yet. Researchers linked a single operator to three AI-agent frameworks used to automate vulnerability discovery, exploitation and attack orchestration. During one five-day period in September 2026, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. More than 600,000 unexpired payment-card records were stolen from two victims, while malicious skimmer activity was linked to a much wider group of e-commerce sites.

The important story is not simply the number of stolen cards. It is the change in the economics of cybercrime.

From AI Assistance to AI-Driven Execution

For several years, security teams have warned that generative AI could help attackers write convincing phishing emails, translate scams, generate malicious code and speed up reconnaissance. Those concerns are now expanding into something more serious: agentic AI.

An AI agent does more than answer a question. It can be given an objective, use tools, make intermediate decisions and continue working through a task. In a malicious context, that can mean scanning systems, identifying weaknesses, attempting exploitation, stealing credentials and moving on to the next target with limited human supervision.

This does not mean AI has created entirely new categories of hacking. Many vulnerabilities and techniques used in recent attacks are familiar. What AI changes is speed, scale and the amount of human expertise required to operate at that scale.

A task that once demanded hours of hands-on work can increasingly be delegated, repeated and run continuously.

Why This Matters to Businesses

The traditional assumption that attackers have limited time and resources is becoming less dependable.

A human attacker needs sleep, must manually switch between targets and can investigate only so many systems at once. Automated agents can work continuously and repeat the same process across many organizations.

For business leaders, this should change the cybersecurity conversation.

Annual vulnerability scans, slow remediation cycles and security reviews performed only when an audit approaches are increasingly difficult to justify when attackers can discover and exploit exposed weaknesses much faster.

Organizations need accurate asset inventories, disciplined patching, strong identity controls, secure application development, continuous monitoring and tested incident-response processes.

E-commerce businesses must pay particular attention to payment environments, third-party scripts, web applications, cloud credentials and unusual changes to checkout infrastructure.

AI Is Lowering the Barrier to Entry

One of the most important implications is accessibility.

Cybercrime has always benefited from automation, but capable AI agents can make complex workflows easier for less experienced operators. They can organize information, generate commands, interpret results and move between steps that previously required deeper technical knowledge.

That does not make every criminal an expert hacker. AI systems still make mistakes, misunderstand environments and can trigger destructive outcomes unintentionally.

But defenders cannot build strategy around attackers making mistakes.

The safer assumption is that capable tools will continue becoming cheaper, easier to use and more autonomous.

Defenders Must Use Automation Too

There is also a positive side.

The same technologies helping attackers move faster can help security teams analyze alerts, prioritize vulnerabilities, investigate suspicious behavior and automate repetitive defensive work.

The answer to AI-enabled cybercrime is not to reject AI. It is to adopt it responsibly while maintaining strong human oversight and governance.

Organizations that adapt best will combine automation with fundamentals: reduce attack surfaces, protect identities, monitor continuously, test controls and respond quickly.

AI-powered attacks are no longer a future scenario. They are becoming part of today’s threat landscape.

The question for businesses is therefore no longer whether attackers will use AI.

It is whether their security programme can keep pace when they do.

Have knowledge, experience, or a powerful idea you want to turn into a book? Get your book published with DevOM Publishing:
https://www.devompublishing.com/

If your business needs cybersecurity services, AI security guidance, cloud security review, or protection against modern cyber threats, visit DevOM Consulting:
https://devomconsulting.com/