The AI Transformation Brief—October 21, 2026
AI made break-ins cheap for attackers, governments are checking where AI comes from, and the cost of supplying AI keeps climbing.
The AI Transformation Brief
// Today’s Signal
AI has made skilled work cheap to buy and very expensive to supply. One hacker spent about $5,000 on AI usage to break into more than 100 company websites. Deccan Chronicle Washington ordered federal agencies to remove DeepSeek and any outside software built with it. IBTimes UK Anthropic's draft stock filing shows about $450 billion in computing agreements behind its growth. NDTV Profit Buyers now carry risk on both sides: cheaper attacks against them, and suppliers whose finances and origins they must check.
// Top Stories
A Chinese-speaking hacker directed AI tools that worked largely on their own to attack more than 1,200 shopping and company websites starting September 25, breaking into more than 100, including sites tied to Deere, SharkNinja and Cummins. The instructions ran fewer than 100 Chinese characters, successful break-ins took about 23 hours of probing, and the campaign cost about $5,000 in AI usage, roughly $50 per break-in. Researcher Snorre Fagerland found it through control screens the hacker left exposed. Deccan Chronicle
A break-in that once took a skilled team now costs about the price of dinner for two, and the attacker barely worked. Every public website, supplier portal and forgotten control panel is now tested by software that does not tire. Cummins said the affected website was run by one of its outside vendors. Deccan Chronicle List every outside-facing system, including those suppliers run for you, and fix known weaknesses within days.
Your company answers for a breach on a supplier's site that carries your name. Contracts should state who checks those sites, how fast fixes happen and who tells customers.
The Department of Homeland Security ordered civilian federal agencies to remove products from Chinese AI developer DeepSeek and stop buying them, in an order dated July 24 and made public on October 19. It also covers third-party products and services built with DeepSeek, so an outside supplier's software may have to go. The department cited risks that information typed into DeepSeek could reach China, along with security weaknesses. IBTimes UK The notice does not define how far "developed using DeepSeek implementations" reaches. DeAI
The rule reaches past the AI supplier to every product built on it, and few buyers know what sits inside the software they license. Government contractors, banks and health systems will face the same question from their own customers. Ask every software supplier which AI systems their products use, write the answer into contracts, and plan how you would replace one within 60 days if a government or customer demanded it.
Anthropic's draft stock-market filing, reported by The Wall Street Journal, shows a first-half net loss of $80.7 billion, $72 billion of it from accounting charges tied to financial instruments it issued. It spent close to $9 billion on computing in six months, holds about $450 billion in computing agreements over seven to 10 years, most of which cannot be canceled, and could spend $750 billion more. It told investors it was profitable on an adjusted basis in the third quarter. NDTV Profit Third-quarter revenue reportedly reached $16.8 billion. Financial News
Anthropic's growth is real, and so is the bill behind it: most of those computing agreements cannot be canceled. Companies building on one AI supplier tie their costs and service to that supplier's finances and its ability to keep raising money. Before your next renewal, ask how prices and service would hold if the listing disappoints, and keep at least one tested alternative ready for your most important work.
// Shelly Palmer Pulse
Palmer's October 20 post describes developers using AI coding assistants to replace smart TV home screens and switch off advertising and tracking software. He warns, "You can seriously mess up your TV." Shelly Palmer The same cheap AI coding that let one hacker attack 1,200 websites lets customers rewrite the products they buy. Expect customers to change your software too.
// What It Means For Your Business
Attacks now cost little, and AI suppliers carry large risks of their own.
Ask for one list this quarter covering every outside-facing system, every AI supplier inside your software and the plan if any of them fails.
Attackers gain from AI faster than most defenders, while AI suppliers commit hundreds of billions to computing.
Security firms, insurers and buyers who can prove where their AI comes from gain bargaining power.
Price the cost of replacing a banned or failing AI supplier, check whether cyber insurance covers breaches on supplier-run sites, and read your AI supplier's finances before signing multiyear commitments.
Keep a current list of which AI systems sit inside every product you use or build.
Patch known weaknesses on public sites within days, and watch for software that probes them for hours.
// The Take
The shift this edition is that AI has collapsed the cost of skilled work for anyone, including attackers, while the cost of supplying AI keeps rising. The assumption it breaks is that security and supplier risk move at last year's pace. The decision it forces is which systems you defend first, which AI suppliers you can prove are safe, and which you could replace.
If a $50 attack found your weakest website tonight, would anyone at your company notice before your customers did?
Make AI accountable. Measure the results. Redesign the business.
Read On
The AI Transformation Brief—October 20, 2026
AI tools are doing harder work, few companies see clear value yet, and each company still answers for what its AI does.
Read the brief →The AI Transformation Brief—October 19, 2026
The limits on AI this week came from power lines, proof of identity and public trust, and money alone will not remove them.
Read the brief →The AI Transformation Brief—October 18, 2026
AI tools now do much of a top AI lab's work, while a breach, federal test rules and China's draft limits show who controls them.
Read the brief →