The $25 Attacker: Find Your Weakest Door Before an AI Agent Does

In September 2026 an attacker pasted a list of 301 online stores into an AI agent. The agents it directed compromised at least 27 companies in under a week, and the operator's own records put the average cost of a completed scan at $25.46. In the same month a small, freely downloadable model wrote a working browser exploit in a lab for $20.40. Microsoft measured the time from a flaw's discovery to a working attack in hours. In June, CISA rewrote the federal government's patching rules because AI may further narrow the time defenders have to react, and set a three-day deadline for the most serious flaws on internet-facing systems.

Those numbers retire an assumption that has quietly shaped most security budgets: that a mid-size or even a large company is not worth a skilled attacker's time. At $25 a target, every company is worth a look, and the look is automated.

The cheap attack does not go after the crown jewels. In October, seven South Korean financial firms, including Shinhan Bank, KB Kookmin Bank and Hana Bank, were breached by a human operator using an open source AI penetration-testing agent. Every attack went in through a system built for employees or partners: a loan-agent inquiry service, an employee mobile work app, an employee sales tool. The three largest banks had spent about $92 million on security the year before. The money protected what it was pointed at. Third parties were involved in 48% of breaches in Verizon's 2026 report, and organizations took a median of 43 days to fix vulnerabilities already being exploited.

This paper is a playbook for the systems an attacker now reaches first. It describes six kinds of side door that recur across 2026's incidents, from contractor portals to public web forms read by internal AI agents. It then sets out five steps. Build an exposure register of every system reachable from outside, including the ones partners run for you. Rank each system with a door score that weighs how easily its login opens against what sits behind it, using NIST's 2025 assurance levels. Set patch clocks by exposure, adopting the deadlines in CISA's BOD 26-04. Watch outbound traffic, including AI service calls, against an AI egress register, because the first reported AI-driven implant takes its orders from commercial AI services. And measure, by test rather than assumption, how long an intrusion on a low-tier system would run before anyone noticed.

It closes with seven clauses for contractor and partner agreements, the SEC disclosure rules that already put this in front of public-company boards, the five numbers a board should see every quarter, and a ninety day plan for the CISO, the chief AI officer and General Counsel. The exposure register, the door ranking rubric and the board's one page are included as templates that can be adopted as written.

The argument in one line: you are worth hacking now, so find your weakest door before an agent does.