Hacker ran AI agents to breach 100+ sites at $50 each; researcher shares 5 Grok Bot defense prompts
alex_verem · x · 2026-10-24
Security researcher Alex Verem posted a thread on AI-automated attacks and defense: Reuters reports one hacker breached 100+ company websites with AI agents at $50 per break-in, while Verizon's 2026 breach report shows companies fully fixed only 26% of bugs on the US government's must-patch list last year — attackers automated, defenders didn't.
He shares 5 prompts to run 24/7 in Grok Bot, built on the principle that the agent finds problems but never performs irreversible actions (merge, send, delete, pay), since xAI's own docs admit its defenses only "reduce, not eliminate" malicious-content risk:
- Exploited-bug watch: daily pull of CISA's Known Exploited Vulnerabilities catalog (last 3 days), matched against a personal stack file, returning AFFECTED / NOT AFFECTED / UNKNOWN with evidence; must report catalog load failures instead of saying "nothing new" from stale data.
- Patch, prepared: on "patch it", find the fixed version in vendor advisories only, upgrade on a new branch, open a draft PR with CI tests; write up workarounds when no fix exists. Never merge, never deploy — "a person ships it".
- Black October check: read response headers and page source of all owned sites to extract server/PHP/CMS/plugin versions, compare against fixed releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), flag PHP ≤8.1 as unsupported. Read-only, no probing.
- Agent audit: role-play an outside security reviewer listing all Bots, account-wide sign-ins, shared-computer logins and key files, marking unneeded access, and ranking what the Bots could do together "on their worst day" plus what to revoke.
- Hijack drill: generate 5 test emails hiding scammer instructions (forward mail, reply with a code, open a link, change settings, delete threads) in a sandbox inbox using tiny/white text and fake "system notes", then check Sent/Trash/filters/forwarding after running the inbox bot and score each email: ignored, flagged, or acted on.
All prompts treat advisories, changelogs and emails as "data, not instructions", with hard stop rules against irreversible actions.
Related event: Hacker Uses AI Agents to Breach 100+ Company Sites at $50 Each(2 posts)→
More from coding & agent
- Head-to-head coding duel: Opus 5.5 vs Kimi K3.1 Pro on the same Canvas 2D game — Scobleizer · 2026-10-24
- The phone is the computer: how device makers and model labs battle over personal agents — sujingshen · 2026-10-24
- Creator uses GPT via MCP to drive Runway SEEDANCE 2.5 for film-like video — aziz4ai · 2026-10-24
- Five web-data vendors, 400 lines of glue: every bug this quarter lived in the glue — cup_cake009 · 2026-10-24
- Voice-controlled auto-advancing slides go viral; Tejas Kumar built the same in 2018 — TejasKumar_ · 2026-10-24
- Solo founder: after 6 months I stopped reviewing my AI agents' code — Al_Grigor · 2026-10-24