AI cyberattacks: what small businesses should do this week

By Keith Motte, Topofmind.AI. Retired AWS Enterprise Support Manager (Healthcare and Life Sciences). Last updated Oct 24, 2026, 7:49 PM PT.

Short answer: AI agents have made it cheaper and faster to find weak spots, for attackers and defenders alike. In the incidents of October 2026, though, the damage came from repairs that were started and never finished: a key that was never switched off, an old app that kept its access, a patch that waited. This week, finish one repair at a time and confirm each one is done.^[1][2][3]

What changed with AI-agent attacks?

Finding problems got cheaper. Anthropic reports that frontier AI models are now capable of discovering and exploiting security vulnerabilities, and that in one study Claude found 493 issues across 25 open-source projects.^[1] Microsoft reports that a state-aligned group it calls Storm-0940 used ARTEX, an open-source penetration testing framework built from AI agents, to automate attacks on hundreds of organizations. In several cases it went from first targeting to privileged cloud access in less than 3 hours.^[2]

Two things are worth keeping in proportion. First, most of those attempts failed. In Microsoft's words: "While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time." One password-spray run produced more than 151,000 failed sign-ins and no successful one.^[2] Second, the same tools help defenders. The PHP Foundation puts it plainly: "Tools now find bugs faster than ever… What tools cannot do is decide on the right fix."^[3]

Why do unfinished repairs matter more now?

When finding a weak spot takes hours instead of weeks, the gap between "we know about it" and "it's fixed and confirmed" is where the risk sits. Each incident below was public by Oct 23, 2026, and each turned on that gap.

PHP: a known problem that took two years to fix

A developer funded by the PHP Foundation found the first signs of the problem behind one of October's critical PHP flaws in 2024, during an external audit. The fix stalled for months. The Foundation calls the delay "a structural failure, caused by both the security team's decision process and its lack of resources." It became the top priority only after outside researchers showed in August 2026 that it allowed remote code execution.^[3] If your site runs PHP, see PHP end of life and the October 2026 releases.

Microsoft 365: access that was already granted

Storm-0940 did not need anyone to sign in. It abused ConnectWise cloud apps that customers had already allowed into their Microsoft 365 tenants, then tried to sign in to more than 2,250 tenants. In some, it went on to change app credentials and privileged roles. Microsoft notes that the presence of an affected app, or even a successful sign-in, does not necessarily mean data was taken.^[2] Its advice includes giving multi-tenant apps only the permissions they need, and this step: "Verify that vendor credential rotation and any tenant-level remediation eliminated remaining unauthorized access." Microsoft also says not to delete affected apps as a first response, so that evidence is preserved.^[2]

LiteLLM: a key that was hidden but never switched off

LiteLLM's attack-chain report traces its October incident to a file committed to a public repository on May 27, 2026, containing a master key. The commit was later removed from the repository's history, but the key itself was never revoked. In October the key was used to obtain a GitHub token belonging to an owner of the project's organization, which led to more tokens, and on Oct 21 a malicious release (1.107.0) was published. LiteLLM calls it "a strong illustration of the risks associated with failing to rotate a potentially exposed key."^[4]

Railway and Zeabur: keys left behind on hosting platforms

Railway says the attackers in its October incident were trying to obtain AI provider API keys, and that environment variables for a subset of customers were decrypted. It asked vendors such as OpenAI, Anthropic, GitHub and Stripe to revoke keys, and recommends that customers who signed up before Oct 21 rotate the keys they store on Railway.^[5] Zeabur's report describes a second incident in under two months: its August rotation did not cover long-lived admin tokens and cloud keys stored in plaintext, and those were the credentials used in October. The attacker was mainly looking for AI service keys. Zeabur tells customers to replace their keys again, even if they replaced them after August.^[6]

The common thread: rotating a key, removing an app or applying a patch is only finished when you have confirmed the old access no longer works.

Can you make the weak spots harder to reach?

Yes, and it pays off even for flaws nobody has found yet. Anthropic's OpenSSH case study is a good example: about 4,500 lines of new, experimental code could be reached by an unauthenticated client in the default setup, even though the feature was off. After fixes the maintainers shipped in OpenSSH 10.6, roughly a fifth of the code an unauthenticated client could previously reach is no longer reachable.^[1] For a small business the same idea is simpler: switch off what you don't use, from old logins and unused plugins to apps that still have access to your email and files.

What should a small business do this week?

Confirm your website's PHP is patched. Ask your host or agency, in writing, whether your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor package with the Oct 21, 2026 fixes, or use the free PHP Patch Check on a domain you own. Done when: a named person has confirmed the version, or the check shows a patched version.^[3][7]
List your AI keys and set a hard spending limit with each provider. Write down each AI service you pay for by API, who owns the login, and where each key is stored. OpenAI distinguishes spend alerts, which only notify you, from hard limits; Anthropic lets you set your own monthly spend limit on its Billing page.^[8][9] Done when: each provider's billing page shows a hard limit, not only an email alert.
Replace keys that may have been exposed, then switch the old ones off. If you stored keys on Railway or Zeabur, follow their guidance and replace them.^[5][6] The same goes for any key that was ever pasted into code, a chat or a shared document. Done when: the old key shows as revoked in the provider's dashboard, and the apps that use the new one still work.^[4]
Review the apps connected to your email and files. In Microsoft 365 or Google Workspace, look at which third-party apps have access and what they can do, and remove access you no longer need. Microsoft Entra lets an admin review and revoke the permissions granted to an app, and in a Google Account the linked apps page shows what each app can access.^[2][10][11] Done when: every app left on the list has a reason to be there and a person who owns it.
Write down what you checked, and when to check again. A dated note of what was confirmed, what is still unknown and who said what is the record that makes the next check faster. The free AI and app access checklist produces one in your browser and never asks for keys or passwords. Done when: you have a dated record and a re-check date on your calendar, about 30 days out.

None of this makes a business attack-proof. It closes the doors that the October incidents went through.

To work through steps 2 to 5 item by item, use the AI and app access checklist. It has 14 statements, keeps your answers in your browser, and ends with the same dated record.

About this guide

The framing that cheap discovery shifts the work toward finishing repairs comes in part from Nate B. Jones's article "AI Agents and Cybersecurity".^[12] The incident details and the steps above are drawn from the primary sources listed below. If a detail couldn't be confirmed in a primary source, it isn't on this page.

Frequently asked questions

Are AI cyberattacks a real threat to small businesses?

AI tools make it cheaper to find and try weak spots at scale. Microsoft reported one AI-agent campaign that targeted hundreds of organizations; most attempts failed, but some reached privileged access in under 3 hours. The doors used were ordinary ones: keys, connected apps and unpatched software.

What is an AI-agent attack?

An attack in which AI agents carry out steps such as scanning, password spraying and abusing connected apps with little human input. Microsoft describes the ARTEX framework this way: a system of AI-driven agents that runs a penetration test from reconnaissance to data theft.

What is the most important thing to do first?

Finish repairs you have already started. Make sure your website software is patched, switch off old keys, and remove app access you no longer need, then confirm each change actually worked.

If I rotated a key, am I done?

Only when the old key is revoked and confirmed not to work. In LiteLLM's incident, a key was hidden from a public repository but never revoked, and it was used months later.

Does the free access checklist ask for my passwords or API keys?

No. It never asks for keys, passwords or tokens. Your answers stay in your own browser and are not sent anywhere.