AI Is Finding Security Holes Every Week. What Business Owners Should Do Now

AI is finding security holes every week now

On 24 October I published Software Security V2, my theory that the way we secure software was built for human-speed attackers, and that AI is changing that.

In the days since, Google fixed 52 security holes in Chrome, several of them found with help from Claude. Anthropic showed an unreleased AI model building working attacks against Chrome, Safari, Android, Windows and Linux. And researchers caught attackers in the wild tricking AI coding agents with a single planted file.

That's the third big security story in two weeks. This article is about what it means for a business that runs on software, and what to do about it.

The short answer:

Security holes are now found every week, in the most important software in the world. AI is helping both the people who fix them and the people who attack.
Updates matter more than ever, and they matter faster. The time between a fix and an attack is now measured in hours.
The tools that build your software are now a target too. If your developers use AI coding agents, and good ones do, ask how they keep them safe.
A simple monthly security routine protects most businesses from most of this. It's at the end of this article.

What Happened Since 24 October

Chrome: 52 security fixes, several found with Claude

On 27 October, Google released Chrome 156 with 52 security fixes: 4 rated critical and 46 rated high. Google's release notes credit several of them, including two of the critical ones, to a researcher at Anthropic, "assisted by Claude".

The same day, Anthropic published research showing that an unreleased internal AI model had found security holes and built working attacks, with what it called "little human involvement", against:

Chrome, through a single click on a malicious link.
Safari, reading another website's data, such as cookies and history.
Android, getting photos off a locked Pixel phone.
Windows servers, crashing them over the network, and Linux machines, taken over without a single click.

Anthropic reported the holes to the companies first, and the attacks it described have been fixed. Anthropic counts 62 Chrome security holes from this work, all fixed as of Chrome 156. Its advice to every software owner: "scanning your own code is more important than ever."

It isn't the first Chrome story this month. Two weeks earlier, a researcher working with AI agents earned a $250,000 reward from Google for a working Chrome attack, which I wrote about in Marian Sorca Thinks Leading AI Companies Can Hack "99%" of What's Connected to the Internet.

AI coding agents hijacked by a file in the Downloads folder

On 25 October, the security firm Forever Security reported an attack it had caught on a real customer's computer. A file called AGENTS.md, disguised as engineering notes, was sitting in the Downloads folder. When a developer started an AI coding agent there, the agent read the file as instructions and tried to install a malicious software package.

The researchers reproduced it against OpenAI's Codex, and showed a related technique against Claude Code that could steal the agent's login token. Their conclusion is the important part: there's nothing for the AI companies to patch, because the agents did exactly what they were designed to do. The defense is how teams use them.

The Weeks Before

The last week isn't an exception. In October alone:

13 October: the $250,000 Chrome attack built with AI agents.
17–19 October: attackers broke into the online console of OpenCode, an AI coding tool, and used customers' stored AI keys. Some users were charged hundreds of dollars, a few over $1,000.
20 October: Wiz described attackers who used fake Google ads to steal cloud logins, then ran AI workloads on the victims' bills: tens to hundreds of thousands of dollars in charges within a day or two.
21 October: PHP2Shell, critical holes in the software behind about 70% of websites, attacked within hours.
21 October: LiteLLM, a popular piece of software used to build AI products, was hijacked. For about two hours, the official release contained malware that stole passwords and keys from anyone who installed it.
21 October: CrowdStrike reported four attacker groups using Claude Code-based agents to break into healthcare, government, retail, technology and software companies, and to steal credentials, medical records and client data.

CrowdStrike's assessment is the sentence I'd want every business owner to read: agentic AI "commoditizes baseline offensive cyber operations." In plain words: attacks that used to need a skilled team now need a laptop and an AI subscription.

What This Means for Your Business

1. Holes are found faster, so updates can't wait

When AI helps find a hole, it also helps turn it into an attack. A month-old update is no longer "a bit behind". For the software that faces the internet, like your website, your browsers and your devices, updating quickly is now part of running the business.

2. Small businesses are worth attacking now

Attacks used to cost attackers time and skill, so they went after big targets. When AI agents do most of the work, it's worth attacking thousands of small businesses at once, looking for the ones that didn't update, reused a password or left an old system online.

3. The tools that build your software are a target

AI coding agents, AI accounts and the keys that connect them have become valuable to attackers. A stolen AI key means charges on your account. A hijacked coding agent means code you didn't ask for, in a product you're responsible for.

If Your Developers Use AI Coding Agents, Ask Them This

Most good developers and agencies use AI coding agents now, and so do we. Used well, they make software better and more affordable. These questions tell you whether they're being used well:

Who reviews the code the AI writes before it goes live? The answer should be an experienced person, every time.
Where are our passwords and keys stored, and can the AI tools see them? Secrets belong in a proper secrets manager, not in files an agent can read.
Do our AI and cloud accounts have spending limits and alerts? A limit turns a stolen key from a disaster into an annoyance.
Do the agents work only inside the project, with approvals switched on? Not in a home folder or the Downloads folder, and not with permission to do anything without asking.
Do you scan our code for security problems? Automated scanning catches many common holes before attackers do.
How fast do you apply security updates to our website and servers? "When we get to it" isn't a good answer anymore.

A Simple Monthly Security Routine

You don't need a security department to be in good shape. Once a month, someone in your business, or someone you hire, should check:

Browsers and devices are updated, on every company computer and phone. Chrome's fixes only apply after it restarts.
Your website software is updated: the platform, plugins, themes and the server underneath, like PHP.
Unused things are removed: plugins, apps, old test sites, and accounts of people who no longer work with you.
Logins are protected: two-step login everywhere, and passkeys or security keys where you can. Fake login pages can now capture one-time codes too.
Spending limits and alerts are set on cloud and AI accounts.
Backups exist and can be restored, stored somewhere other than the system they back up.
You know who has the keys: the domain, the hosting, the code and the admin accounts are in your business's name.

My Take

These things happen so frequently now that I no longer think of them as news. They're the new normal.

My guess, and it is a guess, is that the number of successful hacks on small and medium-sized software platforms has gone up significantly since AI coding agents arrived. The reason behind my guess is simple: this month, core software from the most advanced technology companies in the world was affected. If Chrome, Safari, Windows and PHP have holes that AI can find, most business websites and apps do too.

It's a kind of golden age for attackers. They can use the latest AI to find and use holes faster than most businesses update.

But the same AI works for defenders. Anthropic reported every hole before publishing. Google fixed them. Businesses that update quickly, review the code their AI writes, and know who owns what are in a better position than ever. The ones that don't are the easiest targets there have ever been.

How We Can Help

All of these are on our pricing page:

Security review and hardening, $5,000 – $20,000: the common holes in your website or app found, fixed and checked again.
Launch security check, from $2,500: sign-in, database rules, secrets, security headers, backups, and a web firewall, checked before you go live.
AI-built app to production, $10,000 – $40,000: a prototype built with AI tools made secure, tested and maintainable.
Hacked site or app recovery, from $2,500: urgent cleanup, closing the hole, and getting you back online.
Security care, from $2,000 a month: monthly updates, monitoring, alerts and scans.

Tell us what you run and who builds it, and we'll tell you where you stand.

Frequently Asked Questions

Is AI making websites less secure?

AI is making security holes easier to find, for attackers and defenders alike. Websites that are updated and reviewed regularly benefit from that. Websites nobody maintains become easier targets.

Are AI coding agents safe to use?

Yes, when an experienced person reviews what they write, they only work inside the project, approvals stay switched on, and they can't see passwords and keys. The danger is using them without those controls.

What should I do about the October 2026 Chrome update?

Make sure Chrome is updated to version 156 on every company computer, and restart it. The fixes only apply after a restart.

Can someone run up charges on my AI account?

Yes, if they get hold of your API key or cloud login. That happened to OpenCode users in October 2026, and to companies in a Google Cloud phishing campaign. Set spending limits and alerts on every AI and cloud account.

How often should a small business check its security?

At least once a month, using a short routine like the one above, and immediately when a major hole like PHP2Shell is announced.