Strangers Chatted With a Software Firm’s AI Agents on Its Customers’ Credits. Its CEO Says Attacks Have Never Been This Cheap.

01 What happened at Tobit

In the week of 19 October, Tobit’s systems logged far more automated access attempts than usual. On some SideKick installations, unauthorised users managed to start chats with agents. The way in was a search function in chayns that made agents findable for a short time, including agents that were never meant to be public [ Tobit 2026 ] .

Tobit deserves credit for how it handled this. Its head of core development, Patrick Janning, says the company’s security systems “detected and reported the activity early”, the attack points were closed and the attackers blocked. Customers heard about it directly, and the used credits came back [ Tobit 2026 ] . According to Tobit, external users never reached customer systems or data.

One customer’s account, published by Born, shows what the incident looked like from the inside. Their IT team had not switched on any AI features. They found 31 credits spent by someone they could not trace, and an unfamiliar user in the AI administration they could not delete. Tobit later explained the user as an internal test account added during an old support case and never removed [ Born 2026 ] .

02 The CEO who changed his mind

Ludwig Groten, Tobit’s CEO, wrote about the week on LinkedIn. He opened with an admission most executives would not make in public [ wortfilter 2026 ] :

„Ich habe die Warnungen der KI-Anbieter immer für Marketing gehalten. Diese Woche wurde ich eines Besseren belehrt.“

“I always took the AI vendors’ warnings for marketing. This week I learned otherwise.”

He described bot traffic in volumes Tobit had not seen before, and structured attempts against every system and endpoint the company runs. Attacks used to be almost personal, he wrote. Now they are automated: “Everything that can be reached simply gets attacked, around the clock, at a volume that did not exist before.” His conclusion:

„Cyberangriffe waren noch nie so günstig, einfach und effektiv wie heute.“

“Cyberattacks have never been as cheap, easy and effective as they are today.”

The translations are ours. The point stands in any language. Tobit was not singled out by a patient attacker. It was found by bots that try everything reachable, and one of the things reachable for a few days was a list of AI agents.

03 An agent anyone can find is an agent anyone can use

A web form that is public by mistake leaks what it shows. An AI agent that is public by mistake does work for whoever finds it, and you pay for every token. At Tobit the damage stopped at refunded credits. Three things decide whether the same mistake stays that small for you.

1. What the agent can reach. An agent with no tools and no data answers questions. An agent wired to a mailbox, a CRM or a file share answers them with your data, and a stranger’s prompt can ask it to.
2. Who pays, and when you notice. Bots run all night. Without a per-agent or per-tenant cap and an alert, the first sign is the invoice. That is how the OpenCode users found out about their stolen keys.
3. Who is allowed in. The unfamiliar admin user at one Tobit customer turned out to be harmless. On your own platform, an account nobody can explain is the first thing an attacker looks for.

04 Seven checks on your own agents

Run these against every agent, assistant and chatbot you operate, including the ones a vendor added inside a product you already own.

05 Cheap, automated, everything reachable

Groten’s line fits the rest of October. OpenCode users found their stolen AI keys through the bills. Railway customers learned that the keys they parked in their platform had gone. The Cairn operator ran AI agents against 1,200 websites for about $50 a breach. In each case the attacker spent very little and let automation find whatever was open.

That changes the maths for defenders. A gap that is open for a few days used to be a gap somebody might find. Now it is a gap a bot will find, because the bot checks everything, all the time, for almost nothing. Tobit closed its gap quickly. The question for you is how long yours stays open before you see it.

A bot needs one agent that answers without asking who is there. You can find that agent first. We test your AI agents and the platforms around them from the outside, show you which ones a stranger can reach and what each one can touch, and rank the fixes by what they protect. Enterprise-grade. Not enterprise-priced.