# AI now executes cyberattacks: what happened with Claude and Gemini and how to protect your SMB in Panama > Claude chained flaws and broke into real accounts in under 72 hours; Gemini reached 3 companies in tests. What it means for your SMB and how 24/7 monitoring protects you. URL: https://pgtechcorp.com/en/ai-cyberattacks-claude-gemini/ Actualizado: 2026-09-22 --- In mid-September 2026, two cases came to light that change the conversation about artificial intelligence. It’s no longer just that AI *writes* code: now it also **uses it to execute cyberattacks**. In less than a week, researchers showed how a model like **Claude Opus 5** (Anthropic) chained real vulnerabilities and broke into accounts it didn’t own, while Google revealed that its **Gemini** model reached three companies during its own security tests. It wasn’t a movie: these were reported and patched security disclosures. The lesson for any SMB in Panama is concrete and urgent. ## What happened: AI chained vulnerabilities and got in within hours The first case was documented by the **Hacktron** research team, which used **Claude Opus 5** (Anthropic) to chain two separate flaws and break into **OpenAI** accounts and an internal repository. All in **under 72 hours**. They reported it to those affected, it was patched, and they collected the corresponding *bounty*: this was security research, not a malicious attack. Almost in parallel, Google admitted that its **Gemini** model gained access to **three real companies** during internal security tests — and that it kept it quiet for several months before making it public. The important detail isn’t “which model did it,” but *how*: in both cases, AI didn’t break down a door with brute force; it chained small, known flaws until they became real access. ## Why this is different: targeted attacks got cheap and fast A targeted attack used to require a team of experts and weeks of work. That’s why it was reserved for governments, large corporations and high-value targets. AI changes that equation. **It’s not that “AI turned evil”:** it’s that a tool that chains flaws in hours **lowers the barrier to entry** for targeted attacks. What once cost a specialized team can now be attempted by someone with a model and a bit of context. - **Faster:** from weeks to hours. - **Cheaper:** no need for a large human team. - **Wider reach:** what once targeted a few can now target many. The result is a risk that multiplies for the least-prepared organizations — which are, precisely, small businesses. ## What it means for an SMB in Panama Most small businesses don’t have an internal security operations center (SOC) or 24/7 visibility into their systems. In practice, that means they find out about an incident **when the damage is already done**. And here’s the part that hurts most: the time between “something’s happening” and “it’s too late” is shrinking. If an attack used to show signs for days, today it can complete in hours, overnight. You don’t need to handle “OpenAI data” to be a target. Your corporate email, your billing, your backups and your clients are just as profitable a target for an attacker. Learn more in our guide on [cybersecurity for SMEs in Panama](/en/cybersecurity-for-smes-in-panama-protect-your-business-without-breaking-the-bank/). ## How to protect yourself today: proactive 24/7 monitoring (MPS) The good news is you don’t need to build an internal SOC to get real defense. PG Tech’s **Proactive Security Monitoring (MPS)** combines: - **SIEM** that correlates security events in real time. - A **Spanish-speaking AI agent** that watches and prioritizes alerts. - **Human analysts** who confirm and act. All at a price designed for SMBs: plans from **$149.95/month**. So instead of finding out when it’s too late, someone alerts you *before* the incident escalates. We also shore up the basics: we keep your [systems protected](/en/services/cybersecurity/) with up-to-date patches, MFA and verified backups. See the plans for [24/7 Security Monitoring](/en/services/security-monitoring/). ## Frequently Asked Questions ### Is AI already launching real attacks, or was it just a test? It was security research and disclosure: the findings were reported to those affected and patched. It was not a malicious production attack. The lesson is that AI **speeds up and cheapens** what used to take weeks of specialized work. ### Does this affect me if my SMB doesn’t handle “OpenAI data”? Yes. The method (chaining flaws with AI) doesn’t depend on the target. Your email, your billing and your backups are just as profitable a target for an attacker. ### What can I do today without building a security team? Keep patches up to date, enable MFA, verify your backups, and use **outsourced 24/7 monitoring** (MPS) that alerts you before an incident. ### What is proactive 24/7 monitoring and how much does it cost? A Spanish-speaking AI agent plus human analysts watch your systems, email and data, and alert you. Plans from **$149.95/month** at [pgtechcorp.com/en/services/security-monitoring/](/en/services/security-monitoring/). [Book your free consultation](https://wa.me/50769606453) *Sources: The Hacker News (Claude Opus 5 and access to OpenAI accounts), The Wall Street Journal via Yahoo Finance (September 18, 2026), Quartz (September 18 and 21, 2026) and Forbes Colombia. The facts correspond to security research and disclosure; this is not a real attack against PG Tech or its clients.* --- PG Tech Corporation, Inc. — Obarrio, Ave. Samuel Lewis, PH Marfil, Ciudad de Panama, Panama Contacto: WhatsApp 6960-6453 · https://pgtechcorp.com