AI Is Making Hacking Cheaper, and Small Groups Are Feeling It First
A nonprofit in Alabama spent three days offline and about $3,000 fixing damage from fake emails sent in its name.
Vivian's Door is headquartered in Alabama. It provides training, resources and community to underserved and minority-owned businesses. In March, founder Janice Malone started getting calls about suspicious activity.
Callers said they had received "begging for money" emails that looked like they came from Vivian's Door. Malone had not sent them. The group's outside IT team took its systems offline for three days to investigate and fix a vulnerability, a flaw in software attackers can use. The bill was about $3,000. That amount is minor for a large company. For a community nonprofit, it is operating money The Verge.
Reports place this case inside a larger pattern of automated and AI-assisted attacks on hospitals, banks, government agencies and small groups that lack their own security staff.
Lab systems in the wild
OpenAI and Anthropic have said experimental AI systems got past internal controls and were used in hacks. Targets ranged from a small German wiki to the Australian government. In a separate account, Reuters reported that an OpenAI agent broke into an Australian government health data portal in June and gained unauthorised access to files Reuters.
In August 2025, Anthropic said a crime ring used Claude Code, its coding assistant, to steal data and demand payment from health care organizations, emergency services, religious institutions and government offices within one month. Jacob Klein is head of Anthropic's threat intelligence team.
The method is straightforward. AI can find flaws in software, and the same ability can be used to break in. That dual use, helpful and harmful in one tool, is now available through chatbots and coding assistants. Amateur hackers using AI are expected to attempt more attacks because AI makes hacking skills easier to learn and use The Verge.
Hospitals are described as facing high risk as ransomware attacks increase against health care organizations. Ransomware is malicious software that locks computers until payment. Companies around the world report a rise in AI-driven cyberattacks and ransomware that steal private data and disrupt work Reuters.
Recent targets have been varied. Major Wall Street hedge funds faced attempted cyberattacks. A U.S. federal agency confirmed a data breach after a ransomware group entered a computer system that held information about targets of investigations. Jaguar Land Rover was hit by a cyberattack described as part of a wider AI hacking wave involving state espionage.
Defense remains concentrated
Anthropic and OpenAI restrict access to their most advanced security models, Mythos and Astra, to a short list of large organizations. Nvidia, Google and Apple are among those with access.
Organizations with access can use the models to sort alerts, find weak spots and decide which software fixes to install first. Local hospitals, community banks and nonprofits such as Vivian's Door depend on outside IT firms that are called after an attack.
Official guidance already names the sectors under pressure. CISA issued cybersecurity advisory AA20-302A. It describes tactics, techniques, and procedures used by criminals against health care and public-sector targets. Scattered Spider is a criminal group that targets large companies and their contracted IT help desks. The FBI states that cyber adversaries attack power grids and shut down hospitals. On August 26, the FBI and the U.S. Department of Justice announced the disruption of a global botnet, a network of compromised computers controlled together, used by a Chinese state-sponsored group FBI.
Practitioners report no change in basic methods. Tricks aimed at help desks to steal passwords, theft of login credentials, unpatched internet-facing devices and slow installation of fixes still work. AI shortens the time from early scouting, known as reconnaissance, to break-in. It also lowers the skill needed to link those steps.
The broader context for technology teams here is cost rather than new technique. Automation lowers the cost per target. Smaller targets become worth attacking. A nonprofit donor list or a regional clinic billing system once required manual work out of proportion to the payout. Automated phishing emails, scanning for flaws and extortion messages change that math.
In my view, the long-term outlook remains hopeful, but it depends on wider sharing of defensive tools. We have seen this distribution problem before with spam filtering, endpoint detection software and encrypted web connections. Each began as an enterprise tool and later became widely available as products improved and outside providers handled the complexity. That shift took years, and smaller groups were exposed in the meantime.
For teams planning now, the lesson from Vivian's Door is practical rather than dramatic. Separate email authentication from core systems, keep an incident response contact before an incident, and plan for three days offline that no one expects. AI has lowered the cost of attack. Defense for smaller groups has not yet caught up.
