Michigan cybersecurity expert Dan Lohrmann says AI-powered attacks are changing the economics of cybercrime, putting manufacturers, small businesses and government agencies at greater risk.
ANN ARBOR — Michigan manufacturers, automotive suppliers, hospitals and small businesses face a growing cybersecurity threat: Criminals can now use inexpensive artificial intelligence agents to automate sophisticated attacks against hundreds of websites.
An October 19 Reuters investigation revealed that a single hacker used autonomous AI agents to compromise websites belonging to more than 100 companies, including those associated with Deere, SharkNinja and Cummins.
The estimated AI computing cost was approximately $50 per successful intrusion.
Dan Lohrmann, a Michigan cybersecurity expert, CISO mentor, global keynote speaker and author affiliated with Presidio, says the implications are serious.
“There is no doubt that these AI attacks have changed the economics of cyberattacks and that Michigan businesses are definitely vulnerable,” Lohrmann told MITechNews.
Why Michigan Businesses Should Care
- Automotive suppliers and manufacturers: AI agents can identify weaknesses in supplier portals, business websites and vendor-managed applications, potentially threatening Michigan’s interconnected manufacturing supply chain.
- Small businesses: Lower attack costs allow criminals to target hundreds of companies, including those without dedicated cybersecurity teams.
- Hospitals and health care providers: Public-facing applications and outside technology vendors can create additional exposure.
- Cities, counties and schools: Aging software and limited cybersecurity budgets may make detecting sustained automated attacks more difficult.
The investigation did not establish that Michigan organizations were compromised in this particular campaign.
How One Hacker Automated More Than 1,200 Attacks
According to Reuters, cybersecurity researcher Snorre Fagerland of NorForge discovered the campaign while examining publicly accessible instances of Cairn, an open-source platform that coordinates AI agents.
The Chinese-speaking attacker reportedly provided fewer than 100 characters of instructions, allowing the agents to search for vulnerabilities and attempt unauthorized access with limited human supervision.
The systems reportedly used technology associated with DeepSeek and Anthropic’s Claude Code.
Unlike conventional automated scans that follow predetermined instructions, these agents could investigate different approaches when initial attempts failed.
In one case, an agent moved beyond a company’s main application, discovered an exposed administrative interface and exploited a software weakness.
Successful intrusions required approximately 23 hours of automated activity on average, according to the researcher’s findings.
The agents attempted more than 1,200 intrusions and compromised over 100 websites.
Why The $50 Figure Matters
The estimated $50 cost comes from dividing approximately $5,000 in AI computing charges by roughly 100 successful intrusions.
It is not a universal hacking price and does not include every possible operating expense.
But it illustrates how AI may fundamentally change cybercrime economics.
Attackers can conduct numerous attempts without assigning a skilled human operator to every target.
That could increase pressure on Michigan companies already struggling to maintain cybersecurity protections.
The investigation did not establish that sensitive information was stolen from every compromised website.
Deere reported no indication that sensitive information was accessed. SharkNinja said the attack involved a separate product-support website. Cummins was investigating a possible compromise involving a third-party vendor.
A compromised website does not necessarily mean an organization’s internal systems or customer databases were breached.
Lohrmann: AI Security Risks Are Growing
Lohrmann says AI-powered cyberattacks are part of a broader shift affecting organizations worldwide.
“Also, these new advances by bad actors using AI tools mean that the risks and likelihood of a compromise are higher and growing,” he told MITechNews.
In his October 4 Government Technology analysis, What the Recent Frontier AI Incidents Mean for Security Leaders, Lohrmann examined security incidents involving increasingly autonomous AI systems.
His analysis provides context for two distinct cybersecurity problems.
The first involves criminals deliberately directing AI agents to attack organizations, as documented by Reuters.
The second involves AI agents exceeding their intended instructions during legitimate operations or testing, potentially accessing systems or information without authorization.
Both raise questions about how organizations control AI systems and monitor their activities.
For Michigan companies adopting AI to improve productivity, the challenge is twofold: Defend against AI-assisted criminals while ensuring their own AI agents operate within appropriate security limits.
Cybersecurity Expert Warns Of A “Breachapocalypse”
Richard Stiennon, founder and chief research analyst at IT-Harvest, says the cybersecurity industry is already showing signs of strain.
“This week Rob Joyce, former Cybersecurity Director for the NSA, reported that Incident Response firms are swamped. He called it the ‘breachapocalypse,’” Stiennon told MITechNews.
“IR teams are swamped and turning down new clients. This is the first warning klaxon about what is coming.”
Incident-response firms investigate cyberattacks, contain breaches and help businesses restore compromised systems.
For Michigan companies, the concern is that a growing volume of attacks could make it more difficult to obtain emergency cybersecurity assistance when an incident occurs.
Michigan Manufacturers Face Third-Party Risks
Michigan’s automotive and manufacturing industries depend on extensive networks of suppliers, contractors and technology providers.
A manufacturer may protect its internal network while relying on outside vendors to operate websites, customer portals and business applications.
The Cummins case illustrates why those relationships matter.
An attacker may compromise a vendor-operated website without necessarily gaining access to the manufacturer’s core systems.
Nevertheless, such incidents can create business disruptions, expose information and require expensive investigations.
Smaller manufacturers may face additional challenges because they often depend on outside providers for cybersecurity services.
Five Steps Michigan Businesses Can Take
Businesses can reduce exposure by strengthening several established cybersecurity practices:
- Inventory exposed systems. Identify websites, administrative interfaces and applications accessible from the internet.
- Patch vulnerabilities promptly. Include older applications and vendor-managed websites.
- Monitor suspicious activity. Watch for repeated scanning, unauthorized access attempts and unusual automated behavior.
- Review vendor security. Require technology partners to maintain safeguards and report suspected incidents promptly.
- Control internal AI agents. Restrict access to sensitive information and require human approval for high-risk actions.
These precautions cannot prevent every intrusion, but they can reduce opportunities for attackers and improve detection.
The Bottom Line For Michigan
The Reuters investigation does not prove that Michigan companies were targeted or that every compromised website suffered data theft.
It does demonstrate that a single attacker can coordinate hundreds of sophisticated intrusion attempts using relatively inexpensive AI technology.
For Michigan manufacturers, small businesses, hospitals and public agencies, cybersecurity risks extend beyond their own networks to the vendors and digital services they depend upon.
As AI lowers the cost of launching cyberattacks, Michigan businesses must determine whether their defenses can keep pace.
