AI-Era Cyberattacks: What Companies Should Do

Overnight on October 11 to 12, 2026, attackers took remote control of refrigeration systems at hundreds of French supermarkets and pushed fridges and freezers as high as 50C (122F).

Intermarché's parent Les Mousquetaires said fridges at about 150 of its stores ran at that temperature for six hours, and all affected food was thrown away. Carrefour reported 80 affected stores, and Coopérative U 80 of its 2,000. Monoprix said about 5% of its French stores were hit. Reuters counted at least 350 supermarkets in total. The Paris prosecutor's cybercrime unit is investigating what it called a "large-scale" attack, which caused fires and spoiled stock. Intermarché's chief executive said losses could reach tens of millions of euros nationwide.

The mechanism was almost boring. Attackers changed settings on internet-reachable refrigeration controllers, triggering defrost cycles and raising temperature setpoints. The controllers came from at least three vendors, Danfoss, Copeland and Dixell, according to ANSSI, France's national cybersecurity agency. Danfoss said many affected units were running outdated firmware, and that many had reached end of life and no longer receive security updates.

The warning had been public for two months. On August 9, Claroty's Team82 published vulnerabilities in the Danfoss AK-SM 800A system manager, fixed in firmware R4.3.1. Team82 also reported Copeland XWEB Pro flaws, including CVE-2026-21718, an authentication bypass rated 10.0. Team82 found the administrator credentials are derived from the current date, the MAC address and keys hard-coded in firmware.

No group has claimed responsibility. No ransom was demanded. Sekoia's Félix Aimé said stores in Spain, Portugal, Poland, Germany and Belgium were also affected. Prime Minister Sébastien Lecornu ordered ANSSI to investigate, and France is coordinating with European counterparts.

To be clear about what is known: investigators have not said AI was used in this attack. I am opening with it anyway, because it captures the defining tension of 2026 better than any AI headline.

Attacks got cheap. Doors stayed open.

One in four malicious breaches in IBM's 2026 Cost of a Data Breach Report were AI-enabled, a 56% jump in a year. Those breaches cost $6 million on average, about $1 million more than the $4.99 million global average.

IBM's framing is the one I keep coming back to: "AI is making attacks faster and cheaper, while breaches keep getting more expensive." CrowdStrike's 2026 Global Threat Report put the year-over-year rise in attacks by AI-enabled adversaries at 89%.

Here is the counterintuitive part. Read the incident reports from this year and the entry points look familiar. Default credentials. Unpatched firmware. Over-permissioned service accounts. Exposed API keys. AI did not invent new doors. It made walking through old ones nearly free.

I spent years building a CIAM platform that scaled to over 1 billion users. The lesson that stuck with me: most breaches are identity failures wearing a technical costume. That is truer in 2026 than it has ever been, except now many of the identities are machines and AI agents.

Six attack patterns defining 2026

Six patterns account for most of what I see in this year's incident record. The table is the short version; the detail follows.

Attack pattern	2026 example	Number that matters	First control
Autonomous AI agents as attackers	OpenAI test agents breached Hugging Face (July)	Single pod to cluster admin in under 13 hours	Agent identity, egress limits, behavioral monitoring
Prompt injection against your AI	One payload hit three coding agents (April)	Three vendors' agents leaked secrets from one pull request title	Least privilege, human approval for external actions
Deepfake impersonation	Fake executives, fake job candidates	$764M in deepfake fraud losses in H1 2026 (Surfshark)	Out-of-band verification, liveness checks
AI-accelerated exploitation	Malware querying LLMs at runtime	Access handoff in 22 seconds (Mandiant)	Patch velocity, attack surface reduction
Attacks on AI systems themselves	Breaches of AI models, plug-ins and pipelines	20%+ of organizations hit (IBM)	AI asset inventory, API and plug-in security
Cyber-physical and OT attacks	French supermarket refrigeration (October)	62% of AI-driven attacks hit critical infrastructure (IBM)	Remove internet exposure, kill default credentials

1. AI agents that run the attack themselves

In November 2025, Anthropic disclosed what it called the first reported AI-orchestrated cyber espionage campaign. A Chinese state-sponsored group, tracked as GTG-1002, used Claude Code to run roughly 80 to 90% of the campaign against about 30 targets. Humans stepped in at perhaps four to six decision points per campaign.

In July 2026 came something stranger: an attack with no human attacker at all. AI agents running inside an OpenAI evaluation escaped their test environment and breached Hugging Face. I covered the first disclosure of the sandbox escape in July. Per Hugging Face's forensic account, the agents went from code execution on a single pod to cluster admin across multiple clusters in under 13 hours. Hugging Face reconstructed about 17,600 attacker actions from its logs. A Cloud Security Alliance postmortem says it rebuilt around a third of its infrastructure from clean images.

The detail that should worry every CISO is how ordinary the footholds were. The agents validated 14 publicly exposed Hugging Face credentials with write access, then exploited two zero-days in its file processing. For staging, they took over a third-party app hosted on Modal through a default public API key and a command-injection flaw, according to OpenAI's Black Hat presentation. Machine speed, human-grade mistakes. OpenAI has since notified more than 100 organizations, and I wrote up what every company should do about OpenAI's rogue agents.

2. Prompt injection turns your AI into the insider

On April 30, 2026, CISA, the NSA and their Five Eyes partners issued joint guidance on adopting agentic AI. It warned that prompt injection remains a persistent threat that no single control fixes. The same month, researchers showed that one injection planted in a GitHub pull request title made three coding agents leak secrets. The targets were Anthropic's Claude Code Security Review action, Google's Gemini CLI Action and GitHub's Copilot agent, according to VentureBeat.

This attack skips the employee entirely. It targets the AI reading content on the employee's behalf: an email, a web page, a support ticket. The agent uses its own valid credentials, so the logs look normal.

3. Deepfakes industrialized fraud

Surfshark's tracker puts recorded deepfake fraud losses at $3.7 billion, with $2.5 billion in 2025 alone and $764 million in the first half of 2026. Fake job candidates using face-swapped video interviews added another $100 million. The FBI logged $893 million in AI-related losses in its 2025 Internet Crime Report and flagged that figure as an undercount.

Voice and video are no longer proof of identity. Any approval process that assumes otherwise is already broken. The deepfake CFO video call is now a documented scam type with real cases behind it.

4. Exploitation at machine speed

Mandiant's M-Trends 2026 found the handoff from initial access to a follow-on threat group dropped from more than 8 hours in 2022 to 22 seconds in 2025. It also documented malware families, such as PROMPTFLUX and PROMPTSTEAL, that query LLMs mid-execution to evade detection.

Meanwhile, IBM found that more than half of organizations use agents for threat detection and containment, but only 18% apply them to vulnerability management. Attackers are automating the part defenders are still doing by hand.

5. Your AI stack is now a target

More than 20% of organizations in IBM's 2026 study reported a breach targeting AI models or applications. The most common causes were not exotic model attacks. They were compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%). MCP servers and AI tool chains have become a supply-chain vector in their own right, which is why MCP authorization patterns deserve the same scrutiny as any production API.

6. Attacks that touch the physical world

The French fridges belong here. So does the trend behind them: 62% of AI-driven attacks in IBM's study targeted critical infrastructure sectors, with financial services and energy most concentrated. Building systems, refrigeration, HVAC and industrial controllers sit on networks that were never designed for a world where scanning the entire internet costs almost nothing.

What companies should do now

Start with the boring controls, because that is where 2026's attackers started. I have ordered these by how fast they cut real risk, not by how impressive they sound in a board deck.

1. Find everything you expose to the internet, then shrink it. Refrigeration controllers, building management panels, camera systems, admin consoles. If a management interface is reachable from the internet, assume an AI-assisted scanner has already found it. Put it behind a VPN or zero-trust access, segment it from corporate networks, and replace any device that no longer receives security updates.
2. Kill default and predictable credentials everywhere. The French controllers, the Copeland date-derived admin passwords and the default Modal API key in the Hugging Face incident are the same failure. Rotate factory credentials on day one, and add a check for default credentials to every vendor onboarding and every quarterly audit.
3. Treat every AI agent as an identity, not a feature. Give each agent its own verified identity, short-lived credentials issued per task, and access scoped to exactly what it needs. Remove static API keys from repositories and agent environments. This is standard zero-trust practice applied to non-human identities, and my guide to credential lifecycle management for AI agents covers the short-lived token patterns.
4. Put hard gates in front of agent actions. Model-level defenses against prompt injection lower success rates but do not eliminate them. So enforce controls the model cannot talk its way past: human approval for any action with external effects, outbound network allowlists, and full logging of prompts and tool calls stored where the agent cannot touch them.
5. Stop trusting voice, video and email for money and access. Require out-of-band verification for payments, banking changes and credential resets. Move workforce and customer login to phishing-resistant authentication such as passkeys; the enterprise passkey deployment playbook walks through the rollout. For hiring, run live unscripted interviews and verify identity documents before granting access.
6. Close the speed gap on patching. IBM found organizations using AI and automation in security operations cut breach costs by almost $2 million. Point that automation at vulnerability management and exposure reduction, not only detection. A patch that was available for weeks before an attack is a process failure.
7. Inventory your AI stack like any other production system. List every model, agent, MCP server, plug-in and API key in use, including shadow AI that teams adopted on their own. Review where each one gets its data and what it can change. The AI agent security landscape maps the vendors working on agent identity and runtime controls.
8. Make vendors part of your threat model. Ask suppliers for firmware support timelines, vulnerability disclosure contacts and end-of-life dates, and write them into contracts. The French retail federation is now demanding full transparency from Danfoss after the fact. Ask before.
9. Rehearse an AI-speed incident. Run a tabletop where the attacker is an agent working in minutes, and include a cyber-physical scenario. Pre-approve the tools your responders will use. In the Hugging Face incident, commercial models' safety guardrails refused much of the forensic work, so responders switched to an open-weight model on their own infrastructure.

If you only do three things this quarter, do numbers 1, 2 and 3. They would have blunted most of the incidents in this article.

My analysis: what comes next

What follows is my analysis and prediction, not reported fact.

Machine identity becomes the main battleground. The Hugging Face intrusion was, in essence, a chain of credential and permission failures executed by software. As companies deploy more agents, non-human identities will outnumber human ones by a wide margin. I expect most serious breaches in 2027 to run through an agent, a service account or an API key rather than a person's password.

Cyber-physical attacks will copy the French playbook. That attack demanded no ransom and, as far as anyone has reported, used no zero-day. Its operators still caused losses that one retailer alone put in the tens of millions of euros. Cheap, deniable disruption of food, energy and building systems is now proven. I expect more of it, and I expect regulators to start asking retailers and facility operators the questions they have asked banks for a decade.

Defense shifts from detection to prevention by design. When an attacker moves from access to handoff in seconds, a human reviewing alerts in hours cannot win. The companies that come out ahead will be the ones that remove exposure, shorten credential lifetimes and gate agent actions before anything happens.

Accountability moves upstream to vendors. Outdated firmware on internet-reachable devices will increasingly be treated as a product liability question, not only a customer hygiene question.

The tools changed. The fundamentals did not. Know what you expose, know who and what has access, and make every identity, human or machine, prove itself continuously.

Which of these would your organization struggle with most if an agent-speed attacker showed up tomorrow?

FAQ

What happened in the French supermarket refrigerator attack?

Overnight on October 11 to 12, 2026, attackers remotely changed settings on refrigeration controllers at hundreds of French supermarkets, heating fridges and freezers as high as 50C. Reuters counted at least 350 affected stores across chains including Intermarché, Carrefour, Coopérative U and Monoprix. Stores reported fires and spoiled stock. ANSSI said controllers from Danfoss, Copeland and Dixell were affected. No one has claimed responsibility.

Was AI used in the French fridge attack?

Investigators have not said so. The attack hit internet-exposed controllers, many running outdated firmware, which does not require AI. It belongs in an AI-era discussion because AI makes finding and exploiting exposed devices like these cheaper and faster.

How common are AI-enabled cyberattacks in 2026?

IBM's 2026 Cost of a Data Breach Report found one in four malicious breaches were AI-enabled, up 56% year over year, at an average cost of $6 million. CrowdStrike's 2026 Global Threat Report recorded an 89% year-over-year increase in attacks by AI-enabled adversaries.

What is prompt injection and why does it matter for companies?

Prompt injection hides instructions inside content an AI system reads, such as an email, web page or document, so the AI follows the attacker instead of its owner. CISA and its Five Eyes partners warned in April 2026 that it remains a persistent threat with no single fix. It matters because the agent acts with its own valid permissions, so the activity looks legitimate.

How should companies secure AI agents?

Treat each agent as a non-human identity: give it a verified identity, short-lived credentials, and least-privilege access. Require human approval for actions with external effects, restrict outbound network access, and log every prompt and tool call somewhere the agent cannot modify.

What is the single most effective defense against AI-era attacks?

There is no single control, but the fastest risk reduction comes from removing internet exposure and eliminating default or static credentials. Most 2026 incidents, including the French refrigeration attack and the Hugging Face intrusion, relied on exactly those weaknesses.

Sources

• Reuters via Daily Maverick: Hackers heat French supermarket fridges, sparking fires and food losses (Oct 12, 2026)
• Reuters via NBC News: Investigators hunt hackers who heated French supermarket fridges (Oct 13, 2026)
• CNN: What to know about the cyberattack that targeted supermarket refrigeration systems in France (Oct 14, 2026)
• Infosecurity Magazine: French supermarket cyber-attack impacts more refrigeration controllers (Oct 14, 2026)
• Cybersecurity Dive: Flaws in refrigeration equipment were disclosed months before retail attacks (Oct 13, 2026)
• Refindustry: Danfoss, Copeland and Trane address controller security vulnerabilities (Aug 2026)
• NVD: CVE-2026-21718
• IBM: One in Four Malicious Breaches are AI-Enabled (Jul 29, 2026)
• CrowdStrike: 2026 Global Threat Report findings (Feb 24, 2026)
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign (Nov 13, 2025)
• OpenAI: Hugging Face incident technical report
• Simon Willison: A timeline of the OpenAI accidental attack against Hugging Face (Aug 7, 2026)
• The Hacker News: OpenAI agent used exposed credentials during Hugging Face breach (Jul 2026)
• The Register: Hugging Face rebuilt a third of its infrastructure (Jul 28, 2026)
• CISA and partners: Careful Adoption of Agentic AI Services (Apr 30, 2026)
• VentureBeat: Three AI coding agents leaked secrets through a single prompt injection (Apr 2026)
• Surfshark: Deepfake fraud statistics (Jul 14, 2026)
• FBI IC3: 2025 Internet Crime Report (Apr 2026)
• Mandiant: M-Trends 2026 (Mar 23, 2026)