AI Cyberattacks on Small Business: You Were Never Hidden

Ask a small business owner why nobody has ever bothered to hack them and you will usually get a shrug, followed by some version of the same answer: there is nothing here worth taking. That is not a security policy. It is an economic bet, and for about thirty years it has been a pretty good one.

The short version: The economics behind AI cyberattacks on small business just moved. OpenAI said on September 1 that its upcoming model, Astra, is the first to reach the “Critical” cybersecurity threshold in the company’s own Preparedness Framework. In OpenAI’s words, that means that with the right tools and access it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step. Astra is not broadly released, and its strongest cyber capabilities will be access-restricted. So the near-term consequence is not a wave of break-ins next week. It is that the bet above quietly stops paying, because what protected you was never obscurity. It was the price of a skilled attacker’s time, and that price is falling.

What did OpenAI actually announce?

The announcement, published as Path to Astra, is the end of a process the company has been narrating in public for a month. On August 7 OpenAI said it could no longer rule out Astra reaching Critical cyber capability. On August 18 it paused reinforcement-learning training for roughly two weeks while it built and tested safeguards. On September 1 it confirmed the model had crossed the line.

The threshold itself is worth reading slowly, because the wording is doing a lot of work. OpenAI defines Critical cyber capability as a model that can identify and develop functional zero-day exploits against hardened real-world systems without human intervention, and that can devise and execute novel end-to-end attack strategies when given only a high-level goal. Not “help a skilled person go faster.” Not “explain a known vulnerability.” Find something nobody has documented, and build the thing that uses it, from a one-line instruction.

Alongside that, OpenAI says it trained Astra to more reliably refuse harmful cyber requests, that it will limit access to the most advanced cybersecurity capabilities when the model ships, and that its current production safeguards would, in retrospective testing, have prevented the Hugging Face incident from earlier this year.

Why does this matter for AI cyberattacks on small business?

Because of what the breach data already says about where the growth is.

Verizon’s 2026 Data Breach Investigations Report, which analyzed more than 22,000 breaches between November 2024 and October 2025, found that exploitation of vulnerabilities rose to 31% of breaches, overtaking credential abuse at 13%. Small organizations accounted for 96% of ransomware victims. The median financial impact in the small business segment came in around $38,000.

Put those two things side by side. The attack path that is growing fastest is the one that consists of finding an unpatched thing that is reachable from the internet. That is not creative work. It is search. And search is precisely the kind of labor that gets cheap when you point a capable model at it.

Here is the part that is easy to miss. For most of internet history there were two kinds of attack available to a small business’s adversary. There were mass, generic, spray-and-pray attacks, which were cheap but shallow and which a decent password policy mostly handled. And there were bespoke, targeted attacks, which worked against almost anyone but cost a specialist days or weeks, which is why they were reserved for targets that could pay off. A nine-person landscaping company sat safely in the gap between the two. Not because it was invisible, but because the good attack was uneconomic and the cheap attack was survivable.

An Astra-class capability collapses that gap. It makes the expensive attack cheap. Nothing about your business changed; the arithmetic on the other side did.

The part that cuts the other way

This is genuinely not a doom story, and the sequencing is the reason.

OpenAI expanded its Daybreak program, which gives approved security professionals access to advanced models for defensive work like vulnerability discovery, malware analysis and incident response, before releasing the Critical-rated offensive capability, and it is gating the top tier of that capability on release. That ordering is deliberate, and it is the opposite of how most dangerous technology has historically reached the world. Defenders are being handed the same lift first.

The market is moving on the same clock. On September 1, AIR emerged from stealth with $50 million from Sequoia and Greenoaks to build what it calls a firewall for AI agents, continuously vetting the skills and add-ons those agents pull in. Its own figure is that roughly 27% of the agent add-ons it evaluates fail its security checks. That number is uncomfortable, but a company being paid to find it is a healthier state of affairs than nobody looking.

One honest caution, because we have reported the counterweight before: automated defense is not a drop-in replacement for judgement. A 1Password study of 6,080 AI-generated security patches found that 53.9% of them failed. The same broad capability that makes offense cheap does not yet make defense reliable without a human checking the work. That gap is the actual planning problem, and it is why the useful response for a small business is not “buy an AI security product.”

What should a small business actually do about it?

The uncomfortable good news is that the defenses that hold up here are the boring ones, and they were always available to you.

Write down what you actually run. Every piece of software, every website plugin, every internet-facing box, every service someone set up in 2019 and forgot. Automated discovery finds what is exposed and unpatched. You cannot patch an asset you do not know you own, and most small businesses have never made this list once. This is an afternoon of work, not a project.

Turn on automatic updates and let the vendor do the patching. Given the 53.9% failure figure above, the goal is not to generate your own fixes; it is to receive the vetted ones faster. If your business runs on WordPress, Shopify or any open-source stack, upstream AI-assisted patching already reaches you without you buying anything.

Shrink the number of things facing the internet. Old staging sites, unused admin panels, forgotten subdomains. Each one is a free entry in someone’s scan results.

Treat any AI agent you deploy as a privileged employee, not a feature. Give it the narrowest credentials that let it do its job, log what it does, and vet its add-ons. We have already seen an agent compromise real organizations through weak passwords and an exposed debug page, and separately seen browser agents hijacked by a single planted comment. Neither needed a zero-day.

Test your backups this month. This is the most encouraging number in the entire DBIR: 69% of small and mid-sized businesses refused to pay a ransom because they had reliable backups. That is not a technology advantage. It is a habit, it costs very little, and it is the single thing most likely to turn a catastrophe into a bad week.

None of this requires you to become a security expert, and none of it requires fearing the technology. It requires accepting that the quiet subsidy small businesses have been living on, the one where you were too small to be worth the effort, is being withdrawn. The work that replaces it is unglamorous, cheap, and entirely within your control.

Frequently Asked Questions

Is Astra available to attackers right now?

No. OpenAI has said it plans to make the model available soon while placing limits on access to its most advanced cybersecurity capabilities, and it delayed the launch specifically to build and test safeguards against misuse. The realistic risk is not this model in criminal hands next week; it is that a capability which has been demonstrated once tends to become widely available over the following months and years, which is why the planning window is now rather than later.

Does this mean my passwords and MFA no longer matter?

They matter as much as ever, but they no longer cover the fastest-growing gap. Verizon’s 2026 report found vulnerability exploitation rose to 31% of breaches while credential abuse sat at 13%. Strong passwords and multi-factor authentication address the credential path very well, and you should keep them. The path that is growing is unpatched software reachable from the internet, and no password policy closes that one.

Should I buy an AI security tool for my small business?

Not as a first move. A 1Password study of 6,080 AI-generated security patches found 53.9% of them failed, so these tools are not yet reliable enough to substitute for the basics. Spend the first afternoon writing down what software and internet-facing systems you actually run, turn on automatic updates, and test your backups. Those three steps close more real risk per dollar than any product you could buy this quarter.

Why would anyone bother attacking a business as small as mine?

Because the question assumes a human is choosing targets, and increasingly one is not. Small organizations already account for 96% of ransomware victims, which tells you the selection is largely automated rather than deliberate. When finding an exploitable flaw costs compute rather than a specialist’s week, being small stops being a filter, and the median small business breach impact of around $38,000 is a meaningful number for a company of that size.

One last thing we are genuinely curious about: has your business ever written down a complete list of the software and systems it runs, and if you tried it today, how many forgotten things do you think you would find? Tell us in the comments.