Welcome to Billion Dollar Energy. I went from a farm town in Canada to a Silicon Valley insider and venture capitalist. I share secrets and insights to help you build wealth, legacy, and freedom.
Forwarded this email? Join 55,000+ other professionals every Wednesday.
Billion Dollar Energy is brought to you by:
As a special thank you to billion dollar energy subscribers, get three months of Wispr Flow free from me today!
What does it cost to hack into a company’s website in 2026? Historically, you'd probably guess serious money and a skilled team behind it. The actual answer, according to new research, is about $50 a hit.
In the last few weeks, we’ve seen enough hacks and vulnerabilities that typically span an entire year. What changed, and how can you prepare for the new world we’re barreling towards?
One operator, more than 1,200 targets.
A Chinese-speaking hacker spent roughly $5,000 in AI tokens scanning more than 1,200 company websites and broke into over 100 of them, including Deere, SharkNinja, and Cummins. Security researcher Snorre Fagerland found the campaign after spotting exposed instances of Cairn, an open-source AI agent platform, and Reuters confirmed the victims by reviewing the hacker's own activity logs. The instructions driving the entire operation were fewer than 100 characters. The agents ran themselves after that.
For most of the internet's history, hacking at scale required real technical skill or real money to hire it. Neither is the bottleneck anymore. Fagerland's own numbers put the average cost per attempt, counting the failures, at around $5. At that price, an attacker doesn't need to pick good targets. They can try everyone and keep what works. Being small or boring used to be a kind of protection. It isn't anymore, because nobody has to choose between targets when trying all of them costs the same.
Even the tools builders trust got hit the same week.
Days after that report, Node.js shipped a patch for ten vulnerabilities, including one rated high severity that allows remote code execution through a flaw in how it decompresses data, the kind of thing that triggers automatically on a routine API call. If you or your team ship anything on Node 22, 24, or 26, run node -v. Anything older than 22.23.4, 24.22.1, or 26.12.1 is exposed. Versions 25, 23, 21, and earlier don't get a fix at all.
Put simply, there’s a lot of old software out there that no one is actively monitoring or updating, and sometimes, those systems are running something important.
But defense is getting the same upgrade.
Five weeks before the $50 hack went public, Anthropic disclosed that it had detected and disrupted a separate campaign in mid-September: a Chinese state-sponsored group using its Claude Code model to run an estimated 80 to 90 percent of a cyberespionage operation against roughly thirty organizations, including major tech companies, banks, chemical manufacturers, and government agencies. Human operators stepped in for only four to six critical decisions per campaign. The AI did the rest: inspecting target systems, writing exploit code, harvesting credentials, and sorting stolen data by intelligence value, sometimes firing off several requests a second. It got past Claude's safeguards by posing as a legitimate security firm and splitting the work into tasks that looked routine in isolation.
Anthropic was upfront about the limits, too. The model sometimes invented credentials and claimed to have stolen secrets that turned out to be public, and some outside researchers want to see the underlying logs before fully trusting the 80 to 90 percent figure. A fully autonomous attack with zero human checking still isn't here.
Researchers expect this to compress further.
The UK's National Cyber Security Centre, cited in October's International AI Safety Report, rates it almost a certainty: by 2027, general-purpose AI will make cyber offense more effective and more efficient. The same report notes that the window to patch a disclosed vulnerability, once measured in months, has in some cases shrunk to days. Researchers studying the shift describe AI's real contribution less as building genius hackers and more as compression: it takes recon, phishing, credential theft, and exploit-writing that used to take a skilled team weeks, and finishes it in an afternoon.
How I’m responding to this news.
A $5,000 opportunist and a nation-state intelligence team spent the same month running versions of the same kind of tool. One sprayed it across 1,200 random websites and kept what stuck. The other pointed it at thirty targets picked for their strategic value. Different budgets, same autopilot, and both ends are getting cheaper and faster at the same time. Defense can't depend on flying under the radar anymore, because there isn't a radar. There's just a list, and if you have a password, a credit card, or a kid with a Social Security number, you're on it.
I spent a weekend going through my own setup end to end, plus a plan for if the internet goes down for an extended stretch. I turned it into a checklist: nine fixes for your accounts and devices, plus a two-week plan for cash, water, communication, and backup power. It's live and free here: The Weekend Cyber Cleanup.
Hit reply and tell me: does this change how exposed you feel, or does it still feel like someone else's problem? I read every single response.
Jenny
P.S. One command tells you if you're exposed right now. Open your terminal, type node -v, and check the number against 22.23.4, 24.22.1, or 26.12.1. Ten seconds, and now you know.
Shared this email? Subscribe here.