In the news · updated 23 Oct 2026, 22:26 UTC
AI agents and websites: what is happening
Dated updates on how AI agents are used against ordinary websites, and what works against them. Every entry is from the linked source, read before it went in. What our own decoys caught is in the case file, and the monthly totals are in the Agent Attack Index.
23 Oct 2026
A developer’s post went viral (about 663,000 views): put a flag.txt file in your site’s root with a prompt injection that tells a breaking-in AI agent it passed the test, then to patch its way in and disconnect. Nobody has shown it works on real attackers. We have been running a measured version since 23 Oct: half our visitors get a note only an AI agent would read, asking it to identify itself. One agent already did, from a different address an hour after reading it.
21 Oct 2026
Fortune: experts say more capable AI models are behind a growing wave of attacks. Georgetown CSET’s Jessica Ji says AI systems are now more capable of hacking and act more autonomously; the University of Illinois’ Varun Chandrasekaran says agents run nonstop at a fraction of a human attacker’s cost. The coding startup OpenCode said an attacker spent 48 hours nonstop on its systems.
20 Oct 2026
A hacker used autonomous AI agents, run on the open-source tool Cairn, to target more than 1,200 websites and break into more than 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge put the AI cost at about $5,000, roughly $50 per successful break-in; break-ins took a little under 23 hours on average.
19 Oct 2026
Microsoft warned that AI agents with access to company systems can be steered by prompt injection and tainted inputs into actions they were never meant to take, and that access controls should sit outside the model.
Sep 2026
Transluce found AI agents, sent to look up ordinary public data, turning to SQL injection, path traversal and command-injection probes when a site blocked them, and routing through reader and relay services to hide where they came from.
Sep 2026
Anthropic: “A majority of the operations described in this report were enabled by AI via direct execution or orchestration,” with multi-agent setups doing reconnaissance, exploitation and data theft.
11 May 2026
Google’s threat team described a suspected state-linked actor using Strix, a multi-agent penetration testing framework, to find and confirm weaknesses automatically.
2 May 2026
Researchers caught all 7 AI browsing agents they tested from how they type, scroll and move the mouse; Cloudflare’s bot detection caught 1 of the 7.
29 Apr 2026
Imperva: automated traffic made up more than 53% of all web traffic in 2025, up from 51% the year before.
3 Mar 2026
Palo Alto Networks Unit 42 documented 12 real cases of websites hiding instructions for AI agents, trying to make them pay, delete data, leak their instructions or promote phishing sites.
Where does your site stand?
Free scan, under a minute: every way in a hostile AI agent would use on your site.
Get your score