Short answer
AI hackers do not need to pick a firm worth attacking, because software can try thousands of firms at almost no cost. That changes the old thinking that a small architecture or engineering firm is too small to bother with. Recent reporting describes automated campaigns that probe many websites and break into some of them without a person guiding each step. Basic security habits and the right cyber liability coverage both matter. Policy terms and carrier requirements vary, so review the actual wording.
How AI hackers attack without a person at the keyboard
An AI agent attack uses software that scans websites, tries logins and moves on to the next target without someone typing each command. The attacker sets the goal and lets the software work through a long list.
Earlier attackers had to spend time on every target, so they chose firms that looked valuable. Automation removes that limit. A firm with a website and an email inbox can end up on the list without anyone deciding it should be there.
Why AI hackers make small firms reachable
Cost per attack matters more than firm size. According to a Reuters report in October 2026, one operator used AI agents to probe more than 1,200 websites and reach over 100 companies. The report put the cost at roughly $50 per break-in. The researcher who found the campaign, Snorre Fagerland at NorForge, described the operation as run by a single person.
At that price, an attacker does not need a large payout from each victim. A small ransom, a stolen invoice payment or a hijacked email account can be enough.
What recent AI hacker cases show
Most of the named cases involve large companies and governments. Reporting has not shown that AI agents hit a specific architecture or engineering firm. The useful lesson is how the economics have changed.
- Anthropic reported in November 2025 that a suspected Chinese state-sponsored group used AI to target about 30 organizations. The AI did an estimated 80 to 90 percent of the hands-on work, and Anthropic disclosed and disrupted the campaign.
- CNN reported that up to eight coordinated AI agents mapped 21 Taiwanese government systems and cracked 85 accounts over four days.
- The Hacker News described an autonomous campaign that harvested credentials in under six hours.
These campaigns differ in scale and attribution. Together they show attackers using software for work that once took a team.
What AI hackers look for
Automated attacks tend to go after common weaknesses, since those are the quickest to find at scale. The usual ones include:
- Websites running outdated software that has not been patched.
- Passwords reused across several accounts.
- Email accounts without multifactor authentication (MFA).
An architecture or engineering firm often has all three. Staff share files with clients, send invoices by email and use the same few logins across many tools.
Real-world example
Consider a hypothetical 12-person engineering firm. Its website runs on an older plugin that nobody updated. Two staff members use the same password for email and a cloud file service. Email has no MFA.
An automated tool scans the site and finds the outdated plugin. Separately, a password from an old breach works on a staff email account. The attacker sends an invoice change request to a client who is about to pay a retainer. The client wires funds to the wrong account.
The firm never appeared on a target list. It simply matched the pattern the software was looking for.
What to check this month
Small firms can reduce this exposure with three steps, which the phishing and IT security checklist covers in more detail:
- Turn on MFA for email, file storage and any remote access.
- Switch on automatic updates for the website, computers and software.
- Keep backups offline or separate from the main network, and test a restore.
None of these steps guarantees protection. They close the openings that automated tools usually find first.
Where insurance fits with AI hackers
Insurance pays for the cleanup when the basics are not enough. Depending on the policy, cyber coverage may respond to costs such as incident response, data restoration and business interruption. Terms, limits and exclusions differ, so a policy needs to be read closely.
Many cyber applications ask whether a firm uses MFA and keeps backups. Answering accurately matters, and the cyber application shows what firms are typically asked. When you compare options, comparing cyber quotes explains what to look at beyond price.
Hardcover insight
Firms often tell us they feel too small to matter, and that belief used to carry some logic. It carries less now. The firms that recover best tend to have the basics in place and a policy they understand before an incident, not after. Fixing MFA and backups also tends to make the application process simpler.
Related questions
Do AI hackers target small architecture and engineering firms?
Reporting has not shown AI agents hitting a specific A&E firm. The named cases involve large companies and governments. The concern is that low-cost automation makes small firms easy to reach.
What is an AI agent attack?
It is an attack where software scans systems, tries logins and moves on without a person guiding each step. A human sets the goal and reviews results.
Which weaknesses do automated attacks look for?
Common examples include unpatched websites, reused passwords and email accounts without MFA. These are fast to find across many targets.
What should a small firm do first?
Turn on MFA, keep software updated and maintain backups that an attacker cannot reach. Those steps address the openings automated tools usually find first.
Does cyber insurance cover an AI-driven attack?
Coverage depends on the policy wording, the cause of the loss and the carrier’s conditions. Review the policy or ask a broker how a specific scenario would be handled.