A single operator used AI agents to attack companies at machine speed, launching 105 attacks and ultimately stealing more than 600,000 credit-card records.
Researchers at Gambit Security uncovered the campaign, which used three open-source AI systems to automate work normally done by skilled human hackers. The agents scanned for targets and vulnerabilities, ran exploitation attempts, stole information, and deployed malware.
At least 27 organizations were compromised during an observed five-day burst.
The wider campaign had been running since at least July, and researchers say the operator spent relatively little on AI model usage compared with the scale of the activity. The case therefore offers a concrete example of how AI agents can reduce the human labor needed to run cyberattacks against large numbers of targets, a pattern Jon Markman from Forbes calls "an early, public demonstration of a new normal."
How the card-stealing agentic attack works
The researchers attribute the campaign to a financially motivated Chinese-speaking operator.
The operator, however, was not working alone: three open-source AI agent frameworks — Strix, Cairn, and Hermes — did the heavy lifting, allowing one person to direct attacks against multiple organizations with relatively little hands-on effort.
The process began with Strix scanning potential targets for weaknesses. At the same time, Cairn was used as an autonomous exploitation engine to pursue a path into the target once an objective was set. Hermes then served as the orchestration layer, coordinating the operation and carrying out post-access tasks, including extracting data and modifying compromised infrastructure.
The campaign was unusually persistent. Per HackRead, the agents were configured to probe their targets until they succeeded, timed out, or were stopped, giving them repeated opportunities to find a workable route into a target.
Gambit's logs show just how much activity that translated into. Strix ran 146 deep-mode scans against 138 hosts between August 23 and 31, followed by 105 attack projects from Cairn between September 10 and 15.
Once inside, the agents moved to collect payment data. In two victim organizations, the campaign exfiltrated more than 600,000 credit-card records, and the recovered records were reported as unexpired when collected.
The operation also created a second source of card data by planting web skimmers on compromised sites.
In one observed case, a cron job repeatedly re-injected the skimmer every two minutes, allowing it to return even after defenders removed it. The campaign didn't end with payment card theft.
Gambit found that Hermes also wiped payment-card fields from Magento databases after exfiltration. In one case, an overly broad cleanup routine deleted 180 database tables, suggesting the attacker had enough access to affect core application data and recovery infrastructure, not just read card records.
Open-source AI agents lower the cost of attacks
Leading AI providers are increasingly adding stronger safeguards around their models, but open-source models are creating a different risk.
Models that can be obtained and run outside a provider's hosted service don't have to pass through provider controls, since they can be configured around whatever models are available to the attacker. Hermes, for instance, was directed with Claude Opus 4.6.
That also made the operation remarkably cheap. Gambit's more granular accounting put the average at $25.46 across 101 completed scans. The full campaign cost lies somewhere between $12,000 and $18,000, according to Gambit's OpenRouter token-usage estimate since July.
That shift in economics has implications beyond this campaign. Justin Daniels, a cybersecurity expert, IANS faculty member, and partner at Baker Donelson, told eSecurity Planet that falling AI costs increasingly have to be considered alongside the security risks of the models and infrastructure organizations choose.
“The problem is that cheaper tokens do not magically erase questions about model provenance, training data, intellectual property, privacy, or supply chain risk,” Daniels said.
The larger point is not which model powered the attacks, but how cheaply one operator could automate scanning, retry failed attempts and carry out substantial portions of the intrusion process across many targets.
What should defenders take from this attack?
Retailers should avoid storing raw card numbers and instead use tokenization or other controls. This would make a compromised database less useful because it contains tokens rather than readily usable payment data. IT teams should also monitor payment pages, scripts, databases, and scheduled jobs for unauthorized changes.
Tokenization, however, has a small problem: a skimmer can capture card details while a customer enters them, before the legitimate payment flow tokenizes the data. Therefore, checkout integrity should matter as much as database security.
For shoppers, the practical steps remain simple: enable transaction alerts, check card activity regularly, and report suspicious charges quickly.
The larger lesson is that AI has made persistence and repetition cheap. The strongest defense is therefore to minimize the sensitive data attackers can obtain and make unauthorized activity on the payment path difficult to hide.
Other news: SpyCloud found 258 U.S. water and wastewater organizations with stolen credentials tied to operational technology or remote-access systems/