A criminal operator broke into a Fortune 500 hospitality company, a major US airline, and at least 25 other organisations — and the entire operation averaged just $25 per completed target. The tool? Three off-the-shelf, open-source AI agents stitched together into an automated attack pipeline.

The Register reported the case on Friday, and the numbers are the real story. Not the breach count, not the target list — the unit economics. At $25 per scan, attacking 100 companies costs less than a decent dinner. The marginal cost of ambition is essentially zero.

What actually happened

The attacker assembled three open-source agents — each handling a different phase of the kill chain — into a loosely coordinated workflow. One handled reconnaissance, one probed for vulnerabilities, one managed exploitation attempts. No custom malware. No expensive zero-days. Just publicly available tooling, glued together and pointed at targets.

This maps almost exactly to what Anthropic described in its AI misuse report published earlier this month: AI agents increasingly handling recon, exploitation, and data theft while human operators select targets, set goals, and review outputs. The human becomes the project manager. The agents do the work.

Why this matters more than another breach story

Every prior assumption about the economics of targeted attacks is now wrong. Historically, breaching a Fortune 500 company required either nation-state resources or a highly skilled team willing to spend weeks on a single target. That barrier was the main thing separating opportunistic criminals from sophisticated threat actors.

That barrier is gone. Or at least, it's now measured in dollars rather than months.

The implication for defenders is uncomfortable. Threat models built on "this attacker doesn't have the resources to target us specifically" need revision. When targeting is cheap, the pool of plausible attackers expands to include anyone with a grievance, a laptop, and a credit card.

The SOC problem

Security operations teams are already stretched. The same AI cheapening attack costs is also flooding detection systems with higher volumes of more varied attempts. Each failed privilege escalation that once cost an attacker hours of manual work now costs cents — so they retry immediately, with variations, automatically. The signal-to-noise problem gets worse, not better.

The response can't just be "hire more analysts." The answer has to involve AI-assisted triage on the defensive side too — which means every organisation that hasn't started that conversation internally is already behind.

What to watch

Attribution in cases like this is hard. The Register's reporting doesn't name the operator, and open-source tooling leaves few distinctive fingerprints. But law enforcement and vendors will be watching for clusters of similar TTPs across victims — the operational signature of an automated campaign is different from a human attacker, even if the tools are generic.

For Australian organisations: the ACSC's 2026 threat landscape reporting has flagged AI-assisted attack tooling as an emerging priority. This case is the clearest public example yet of what that actually looks like in practice. If your threat model doesn't account for $25-a-scan automation, update it this weekend.