Saturday 24 October 2026 • By Timothy, CPA — Managing Director, Professional Financelink (PFL)

A small key opening a long row of identical doors while a single gatekeeper booth checks one door at a time, flat geometric illustration in blues, no people

AI News Wrap-Up: One Hacker Spent About $5,000 on AI and Got Into 100+ Company Websites. The Auditors' Answer Arrived the Same Day.

Five stories from the week of 17–23 October — the cost of an attack collapsing, two AI-found flaws that took government websites offline, Microsoft telling customers to treat agents as insiders, a CPA-led assurance report for AI agents, and a CFO arguing that "more output" is the wrong measure.

This week the thread arrived on Monday. On the same day, Reuters described an attacker using AI agents to break into company websites at about $50 a success, Microsoft published controls for treating AI agents like staff who could go rogue, and the US accounting profession announced an assurance report for AI systems. Attack, control and assurance — all things finance already knows how to think about.

1. One attacker, AI agents, about US$5,000 in tokens — and more than 100 company websites

Reuters reported on 19 October that a Chinese-speaking hacker used AI agents, running on an open-source platform, to break into the websites of more than 100 companies, after trying more than 1,200 sites. The activity was found by a researcher at security firm NorForge, who estimated the campaign used a mix of DeepSeek and Anthropic's Claude Code, cost roughly US$5,000 in tokens — about $50 per successful break-in — and that a typical intrusion took about 23 hours. Targets were e-commerce sites in the US, Canada, Japan and Australia. Deere, SharkNinja and Cummins acknowledged incidents, each describing a contained or third-party site. Reuters could not determine whether data was taken.

Tim's take: Put the $50 in your risk register, not your newsfeed. For years the comfortable assumption in a mid-sized organisation was "we're too small to be worth anyone's time." That assumption was an economic argument, and the economics just changed: when an attempt costs a few dollars and runs unattended for a day, the attacker doesn't need you to be worth much. Notice too where the damage landed — product support sites, a vendor-run website. The side door, not the ERP. Finance's practical job is the list: every site, portal and plug-in the organisation pays for, and who maintains it. Patching is IT's or the vendor's job; making sure every paid-for site has a named owner who can say when it was last patched is ours.

Source: Reuters via Honolulu Star-Advertiser

2. Two AI-found PHP flaws, and governments took their own websites offline

On Wednesday 21 October, PHP — the language behind a large share of the world's websites — released fixes for two critical flaws that could let an attacker run code on a server without logging in. The flaws were found with help from AI tools; OpenAI said researchers worked with security firms to prepare fixes before disclosure. The NSA and FBI advised taking systems offline if they could not be updated promptly, and government services in Finland, France, Belgium, Germany and the Netherlands went fully or partly offline as a precaution. Australia's cyber agency said it was not aware of active exploitation but joined other agencies in urging organisations to find and patch affected systems.

Tim's take: The detail that matters for a non-technical reader: updating the website's content or plug-ins does not fix this. The PHP software underneath has to be updated, usually by your host. So the question for Monday is not "are we secure?" — it's "who hosts our website, member portal and donation page, and have they confirmed in writing that PHP is patched?" If nobody in the organisation knows who to ask, that is the finding. The same AI that found these flaws faster will find the next ones faster, for both sides.

Source: ABC News 4, Reuters factbox via The Star, TechCrunch

3. Microsoft's new rule for AI agents: no standing access, and a smaller leash as risk rises

On 19 October Microsoft described new controls for AI agents in Microsoft 365 E7, framed around treating agents as potential insiders. Under "Dynamic Permissions", an agent starts with no access of its own and receives only what a single task needs, for the length of that task — and never more than the person it acts for could access. Each agent gets a continuously updated risk rating, and as risk rises the response steps up: write access removed, then some data withdrawn, then a person must approve the next step, and finally the agent is stopped. Microsoft did not say when the features will be available or whether they will cost extra.

Tim's take: Strip out the product names and this is segregation of duties with a dial on it. No standing access, task-length permissions, escalation to a human when something looks wrong — that is how a well-run finance team already handles a new staff member near the bank file. What is new is that a large vendor has built it into a product and published the design. That makes it a useful reference point for any agent tool, whether or not you run Microsoft — not a certification, but three fair questions to put to a vendor: does the agent hold permanent access, or access per task? Can it ever exceed the person it acts for? What happens, automatically, when it behaves oddly?

Source: The Next Web, ERP Today

4. The AICPA announced a CPA-led assurance report for AI systems and agents

The American Institute of CPAs and the Artificial Intelligence Underwriting Company announced a joint offering on 19 October: a single CPA-led engagement combining a SOC 2 report with AIUC-1 certification, a standard for AI agent safety, security and reliability. The difference from a policy review is live testing — agents are run against hundreds of risk and attack combinations, including hallucination, data leakage, manipulative requests and prompt injection. Both parts renew annually, with quarterly technical retesting. Several CPA firms are already delivering it, with a full launch expected in early 2027. The announcement is US-based and silent on availability elsewhere.

Tim's take: This is the one I'd forward to the audit committee chair. We have spent two years asking AI vendors "how do we know it works?" and getting a values statement back. A SOC 2-style report with live testing is the first answer I've seen in a format we read every year. Two cautions. There's no Australian equivalent that I could find, so don't expect a local vendor to hand you one yet. And a certificate covers the vendor's system at a point in time, not how your team uses it. You still own the second half.

Source: AICPA & CIMA, Journal of Accountancy

5. Workday's CFO: twice as many reports is not a better business

Speaking to Fortune on 21 October, Workday CFO Zane Rowe said ROI matters but is not the full picture of AI's value. He described success in terms of better decisions, anticipating problems, advising business leaders and greater organisational capacity — and, as Fortune put it, generating twice as many reports doesn't necessarily make the business better. The same piece cited a Conference Board study of 775 leaders, which found AI adoption is widespread but many organisations lack clear accountability for AI-related decisions.

Tim's take: I agree, with one warning: "beyond ROI" is easily heard as "don't bother measuring." The better reading is to measure the right things. A decision made earlier, an exception caught before lodgement, a variance explained before the board asked — those can be counted. The Conference Board finding is the sharper one. If nobody owns an AI-assisted decision, you don't have an AI strategy, you have a liability with no name on it. For each AI workflow, write down one owner.

Source: Fortune

Read together: attacks got cheap, so the side doors matter. Patches now depend on someone knowing who your host is. Agents need the access discipline we already apply to people. Assurance is arriving in a format finance can read. And every AI decision needs an owner. None of it requires choosing a model. All of it requires a list, a name and a date.

This post is general commentary based on publicly available information and does not constitute legal, technical or investment advice. Items one and two concern live security matters; follow your IT provider and the Australian Cyber Security Centre for current guidance. A standing note for anyone using AI tools on payroll, participant or client data, or financial figures: confirm whether the vendor retains your inputs or uses them to train its models, and where there is a choice, prefer a configuration in which your data isn't retained for training. Either way, strip out names, participant numbers and bank details first — a no-training setting doesn't stop the data leaving your organisation.

Could you list every website, portal and AI tool your organisation pays for — and who owns each one?

That list is now the start of both cyber hygiene and AI governance. PFL provides senior-level outsourced finance, management reporting, and AI automation for Australian NFP, NDIS, and SME organisations — including the vendor, access and ownership records that make AI use defensible.

Talk to PFL →

Timothy, CPA is Managing Director of Professional Financelink (PFL), providing senior-level outsourced finance, management reporting, and AI automation for Australian NFP, NDIS, and SME organisations. 20+ years in finance leadership across NFP, NDIS and SME.

Sources:

Tomorrow: Finance Reads of the Week — a lender ended up owning seven childcare centres, and this week they went into administration; the retention-payment deadlines that actually decide childcare cash, four NDIS prices rising on 1 December, and the full-year aged care results.

Search This Blog

Finance Intelligence