The new cyberattacks come from AI agents: what hotels should watch

The cyberattack playbook changed. According to Hosteltur, AI agents are now being used to carry out attacks that used to require a human on the other side, scanning systems, probing for weak points and adapting on the fly. For the travel sector, that shifts the threat from a nuisance to something hotels need to plan around.

Hotels sit on exactly what these tools want. A PMS holds guest names, passport numbers, payment tokens and stay history. A booking engine connects to that same database. A channel manager pushes rates and availability to a dozen third parties. Every one of those links is a door, and most properties have no one whose job is to watch them.

My view: the fix is not buying another cybersecurity product on top of the stack. It is cutting the number of systems that touch guest data, forcing MFA where the PMS allows it, and asking every vendor in your stack for a written answer on how they handle an incident. That conversation is free and most hotels have never had it.

The good news is that doing the basics well already puts a property ahead of most of its comp set.