How to Lock Down Your Accounts in 30 Minutes Now That AI Agents Do the Hacking
The robots learned to try every door handle. Make sure yours is locked.
What happened
Reuters reported on October 19 that one hacker pointed a pack of autonomous AI agents at more than 1,200 websites, mostly online shops, starting in late September. The agents got into more than 100 of them, including sites belonging to Deere, SharkNinja and Cummins, working on their own for hours with only short instructions. The companies say they fixed the problems or are investigating, and Reuters could not tell how much data was taken.
The part worth remembering is the price. Reuters puts it at about $50 per successful break-in, with roughly one attempt in ten succeeding. Breaking in used to take a skilled person days. Now it runs overnight for the price of dinner, which means attackers no longer need to pick a target. They try everybody and keep whatever opens.
That is oddly good news for you. The tools are new, but they still mostly walk through doors left open: reused passwords, no two-step login, old software. Close those and you are in the nine out of ten that don't get in. The U.S. cybersecurity agency's own checklist for the public is four items long.
What to do
- Start with your email. It's the master key: every "forgot password" link goes there. Turn on two-step login (or a passkey) in its security settings, and check that the recovery phone number and backup email are ones you still control.
- Get a password manager. Let it create a different long password for every account, starting with email, bank and anything that stores a card. One reused password is all an automated attack needs.
- Turn on two-step login everywhere money lives. Bank, credit cards, retirement account, shopping sites, phone carrier. An app or passkey beats a text message, but a text code beats nothing.
- Switch on automatic updates. Phone, computer, browser and router. Most break-ins use holes that already have a fix.
- Back up what you'd cry about losing. Photos and documents to a cloud account or an external drive, on a schedule, not 'someday.'
- Treat surprise messages as suspects. A text, email or call that pushes you to log in, pay or install something right now gets checked through a number or website you already know.
The prompt
I want to do a 30-minute security checkup on my own accounts and devices. Act as a patient coach. Here is a list of my accounts and devices, without any passwords: [list, e.g. Gmail, bank, credit card, Amazon, iPhone, Windows laptop, home Wi-Fi router]. 1. Put them in order of what to secure first, starting with my email. 2. For each, tell me in plain steps how to turn on two-step login or a passkey and where to find the setting. 3. Remind me to turn on automatic updates for each device. 4. End with a one-page checklist I can tick off. Never ask me for a password, code or account number, and remind me not to type them here.
Settings menus change often. If a step doesn't match what you see, search the company's own help page.
Where it still needs a grown-up
- No checklist makes you unhackable. It makes you a harder, less profitable target, which is the point.
- Never type passwords, one-time codes or account numbers into a chatbot, and never give them to anyone who calls or messages you, however official they sound.
- Lost access to your email or think you've been hacked? Go to IdentityTheft.gov for a step-by-step recovery plan, and call your bank directly if money is involved.
The verdict
The least exciting half hour of your week, and the one most likely to pay off.