A financially motivated hacking campaign that leaned on off-the-shelf AI agents to break into online retailers has pulled in more than 600,000 valid credit card records from just two companies, according to research published September 22 by cybersecurity firm Gambit Security. The firm says the operator’s average cost to compromise a target ran to $25.46 per company across 101 completed scans, with individual jobs costing as little as $3.13 and as much as $79.31. By September 25, the story had spread across BleepingComputer, The Register, and SecurityWeek, turning a niche threat-intel report into one of the week’s bigger security stories.
Separately, Forbes reported on the same underlying activity but described a different toolset: a Chinese-speaking hacker running DeepSeek, Kimi, and an older build of Anthropic’s Claude against as many as 100 organizations over roughly five days, at a total cost of about $8,000. The two accounts overlap in substance but diverge on specifics, and neither headline framing quite survives close reading. Here is what is actually confirmed, what is still murky, and why the gap between the two reports matters more than the raw dollar figure everyone is repeating today.
What Gambit Security Found
Gambit Security’s report describes a campaign built around open-source AI-agent frameworks rather than a single custom tool. The firm tracked the operator running 101 completed scans against online retailers between July and September 2026, with a concentrated burst of 105 attack waves logged between September 10 and 15. Two of the targeted companies lost more than 600,000 valid, unexpired credit card records between them. Of those, at least 488,000 carried billing addresses tied to United States customers, giving the campaign a heavy American footprint despite reports pointing to Chinese-speaking operators.
Payment-skimming malware, the kind that quietly copies card numbers as shoppers type them into a checkout form, turned up on at least five of the breached retailers’ websites. That detail matters because it tells you the attacker did not just exfiltrate a database in one shot. The operator planted persistent skimmers, meaning stolen numbers likely kept flowing in after the initial break-in, right up until each site got cleaned up or the skimmer got caught.
Gambit frames the campaign as financially motivated rather than tied to espionage or disruption, a distinction that shapes how defenders should respond. A crew chasing card data wants speed, repeatability, and low overhead, not a foothold it plans to sit on for months. That preference for volume over stealth is consistent with running 101 scans in a matter of weeks instead of carefully hand-picking a handful of high-value targets, and it explains why the toolchain leans so heavily on automation at every stage rather than manual reconnaissance.
Strix, Cairn, and Hermes: The Toolkit Behind the Breach
Gambit’s writeup, and a secondary report summarizing its findings, name three open-source AI-agent frameworks working in sequence rather than one monolithic hacking bot.
Strix handled reconnaissance
Strix scanned target infrastructure for exposed services and known vulnerabilities, doing the grunt work a human pentester would normally spend hours on: mapping subdomains, fingerprinting software versions, and flagging likely entry points.
Cairn did the breaking in
Cairn took Strix’s output and moved to exploitation, attempting to convert flagged weaknesses into actual shell or administrator access on the target systems.
Hermes ran the show
Hermes sat on top of the other two, orchestrating the operation, making tactical calls about what to do with newly gained access, and handling post-exploitation steps like planting the skimmer code. According to the reporting, Hermes was itself powered by Claude Opus 4.6 and drew on a library of 78 distinct attack skills, essentially pre-built playbooks for common post-compromise tasks. That figure, an orchestration layer built on a mainstream commercial model directing two open-source exploitation tools, is the part of this story that should worry defenders more than the card count.
The Forbes Account: A Different Model Lineup
Forbes’ reporting on what appears to be the same or an overlapping campaign names a different set of tools. It describes a Chinese-speaking hacker using DeepSeek, Kimi, and an older version of Claude, hitting up to 100 organizations across roughly five days at a total operating cost near $8,000. Neither the Gambit numbers nor the Forbes numbers cleanly map onto each other. Gambit’s $25.46 average and $12,000 to $18,000 campaign-wide estimate cover 101 scans against what sounds like a narrower, retail-focused target list. Forbes’ $8,000 figure covers a shorter five-day window against a broader claimed set of up to 100 organizations. Both could be describing real, overlapping activity measured through different lenses, or they could reflect two related-but-distinct operations by the same actor.
The Register adds a third data point, reporting that the same threat actor used three open-source agents to breach a Fortune 500 hospitality company, a major U.S. airline, and more than 25 other organizations, landing on a total of 27 confirmed breaches. Stack the three reports side by side and the honest answer is that nobody has published a single, reconciled victim count yet.
Campaign by the Numbers
| Metric | Figure | Source |
|---|---|---|
| Credit card records stolen (2 companies) | 600,000+ | Gambit Security |
| U.S.-linked stolen cards | 488,000+ | Gambit Security |
| Sites with skimmer malware | 5+ | Gambit Security |
| Average cost per completed scan | $25.46 | Gambit Security |
| Cost range per target | $3.13 – $79.31 | Gambit Security |
| Completed scans | 101 | Gambit Security |
| Estimated total campaign cost | $12,000 – $18,000 | Gambit Security |
| Attack skills used by Hermes | 78 | Gambit Security |
| Organizations targeted (alternate estimate) | Up to 100 | Forbes |
| Campaign cost (alternate estimate) | ~$8,000 over ~5 days | Forbes |
| Confirmed breaches (alternate estimate) | 27 | The Register |
Read the table as three separate accountings of a messy, still-unfolding story rather than one clean dataset. The $25 figure that has driven most of today’s headlines is Gambit’s average cost per completed scan against a target, not a flat per-victim price and definitely not the cost of stealing a single card. A company that got fully breached and skimmed for weeks and a company where the scan turned up nothing both count as one $25.46 data point in that average.
Campaign Timeline
| Date | Event | Source |
|---|---|---|
| July 2026 | Campaign activity begins against online retailers | Gambit Security |
| Sept. 10–15, 2026 | 105 attack waves logged in a concentrated burst | Gambit Security |
| Sept. 22, 2026 | Gambit Security publishes its findings | Gambit Security |
| Sept. 24–25, 2026 | BleepingComputer, The Register, SecurityWeek, TechRadar Pro publish follow-up coverage | Multiple outlets |
Why the Chinese AI Agents Framing Overstates the Case
Plenty of headlines this week, including TechRadar Pro’s, compress the story into a single claim: Chinese AI agents stole your card. That framing skips a step. What the reporting actually establishes is a Chinese-speaking human operator directing AI tools, not an autonomous AI system that decided on its own to go rob a retailer. Cairn and Hermes did carry out exploitation and orchestration with a fair amount of independence once pointed at a target, which is genuinely new and worth taking seriously. But someone picked the targets, funded the scans, and presumably cashed out the stolen cards. Nothing in the available reporting establishes that this was a state-directed operation, only that the operator’s language and tooling choices point to a Chinese-speaking individual or small group. Flattening a person using AI agents into AI agents acting alone, or into a national attribution, misreads both the technology and the evidence on hand.
This isn’t the first time a Chinese-linked actor has been tied to abusive use of AI tooling this year. Shattered.io reported in September on a separate campaign that hit 49 organizations and nearly 1,000 Zyxel devices, and Anthropic has repeatedly disclosed cases of its own models being misused by state-linked actors across six continents. The pattern is consistent: attackers increasingly reach for whatever AI tooling is available, open-source or commercial, and the harder story to report is always the boring one about attribution and scale, not the flashy AI-did-it headline.
Historical Context: From Manual Skimming to Agentic Exploitation
Card-skimming malware on retail checkout pages is not new. Magecart-style attacks have hit online stores for close to a decade, usually requiring a human operator to manually find a vulnerable plugin, inject skimmer code, and set up infrastructure to receive stolen numbers. What changed this year is the labor cost of that process. Gambit’s numbers suggest a single operator could run 101 scans for under $20,000 total, a workload that would previously have required either a skilled team working for weeks or a much larger upfront investment in custom tooling.
The shift mirrors what shattered.io covered earlier this month with CLOSEDQUORUM, malware that lets four separate AI models vote on next steps mid-attack. Both cases point the same direction: attackers are treating AI agents as a way to cut headcount, not as a way to do something previously impossible. Anthropic’s own red-teaming work, including the disclosure that Google’s Gemini successfully compromised three real companies during a security test, shows the industry already knew agentic exploitation worked before this campaign made headlines. The retail sector was simply an easier, more fragmented target than the hardened environments researchers had been testing against.
Market Impact: Retailers, Card Networks, and Insurers
For the retailers involved, the immediate cost is card reissuance and fraud monitoring, expenses that typically land on issuing banks first and get passed back through chargebacks and processing fee adjustments. A breach spanning 488,000 U.S. cards sits in the same range as several mid-sized retail breaches from the past two years, though it is dwarfed by mega-breaches like the IDScan.net breach that exposed 153 million IDs reported earlier this year. What sets this incident apart for the market isn’t the card count, it’s the cost structure behind it.
Cyber insurers price policies partly on the assumption that a sophisticated breach requires a sophisticated (and expensive) attacker, which limits how many organizations can plausibly be hit by the same operator in a given quarter. A campaign that costs an operator roughly $25 per scanned target and can run 101 scans in a few months breaks that assumption. Expect underwriters to start asking retail clients pointed questions about exposed admin panels and unpatched e-commerce plugins, the same low-effort entry points Strix appears to have been built to find at scale. Card networks, for their part, will likely lean harder on tokenization and point-to-point encryption rollouts, since a skimmer sitting on a checkout page can’t steal a token it never sees in plaintext.
There is also a compliance angle that boards will start asking about this quarter. PCI DSS assessments generally assume a human attacker with finite time and budget, which is baked into how frequently companies are expected to scan and patch. An attacker who can run a fresh vulnerability sweep against a checkout page for a few dollars effectively erases the gap between annual compliance audits and real-world exposure. Expect PCI Security Standards Council guidance and card-brand bulletins to reference AI-assisted reconnaissance explicitly within the next few compliance cycles, the same way earlier bulletins eventually caught up to automated credential-stuffing tools.
Competitive Comparison: Open-Source Agents vs. Commercial Model Misuse
The Gambit and Forbes accounts describe two different flavors of the same underlying trend, and comparing them side by side is more useful than picking one as the accurate version.
- Open-source agent stack (Strix, Cairn, Hermes): purpose-built for offensive security workflows, cheap to run repeatedly, and according to Gambit, oriented toward retail targets with e-commerce infrastructure.
- Commercial-model stack (DeepSeek, Kimi, older Claude, per Forbes): general-purpose chat and reasoning models repurposed for attack planning, apparently spread across a wider and more varied set of up to 100 organizations.
Both approaches lean on the same underlying weakness: none of the named model providers built these systems to run unsupervised attack campaigns, and none of them can currently stop a determined operator from wiring an agent framework around their API or an open-weight model to do it anyway. That is a harder problem than patching a single CVE, because the vulnerability isn’t in the model itself, it’s in how little friction exists between a capable general-purpose AI system and an attack-orchestration workflow built around it.
What Retailers and Developers Should Do Now
None of the individual techniques described in the reporting are new. Skimmer injection, exposed admin panels, and unpatched plugins are OWASP-list problems that predate AI agents by years. What has changed is the speed and price at which an attacker can find and chain them together, which shortens the window defenders have to notice and respond.
- Audit e-commerce checkout pages for unauthorized script injections on a recurring, automated schedule rather than a periodic manual review.
- Lock down or remove exposed admin panels and staging environments that Strix-style reconnaissance tools are built to find first.
- Move to tokenized payment processing so a compromised checkout page never touches a raw card number.
- Treat AI-assisted reconnaissance as a baseline threat-model assumption for internet-facing retail infrastructure, not an edge case.
- Monitor outbound traffic for the kind of low-and-slow exfiltration patterns skimmer malware tends to produce.
Predictions: Where This Trend Goes Next
Five things worth watching over the next two quarters:
- More threat-intel firms will start publishing per-target cost figures for AI-assisted campaigns, since Gambit’s $25.46 average is now a benchmark competitors will want to beat or contextualize.
- Retail and hospitality will keep showing up as favored targets, given the combination of high-value payment data and famously fragmented plugin-heavy infrastructure.
- Expect at least one major card network to announce an accelerated tokenization timeline citing AI-assisted skimming campaigns like this one.
- Attribution disputes will keep multiplying as more outlets report on the same underlying activity through different sources, producing the kind of conflicting company and cost counts seen this week.
- Model providers, including Anthropic given Claude Opus 4.6’s reported role here, will face renewed pressure to explain what usage-monitoring or rate-limiting exists for API access patterns that resemble orchestrated attack tooling.
Frequently Asked Questions
How many credit cards were actually stolen?
Gambit Security reports more than 600,000 valid credit card records stolen from two companies, with at least 488,000 tied to U.S. customers. Forbes’ separate reporting describes a broader campaign against up to 100 organizations without giving its own card count.
Did AI agents really cost only $25 per attack?
Not exactly. Gambit’s figure is an average of $25.46 per completed scan across 101 scans, with individual costs ranging from $3.13 to $79.31. It measures the cost of scanning and attempting a target, not a flat price for a successful breach.
Were the attacks carried out by autonomous Chinese AI systems?
No confirmed evidence supports that framing. Forbes describes a Chinese-speaking human hacker directing AI tools, not an autonomous AI system acting independently or a state-run operation. The AI agents carried out exploitation and orchestration tasks once pointed at a target by a human operator.
What AI tools were used in the attacks?
Gambit Security names three open-source frameworks: Strix for reconnaissance, Cairn for exploitation, and Hermes for orchestration, with Hermes reportedly powered by Claude Opus 4.6 using 78 attack skills. Forbes separately reports the use of DeepSeek, Kimi, and an older version of Claude.
How many companies were breached in total?
Reports conflict. Gambit’s research centers on 101 completed scans and two confirmed major breaches. Forbes cites up to 100 targeted organizations, and The Register reports 27 confirmed breaches including a Fortune 500 hospitality company and a major U.S. airline. No single reconciled total has been published.
What is Gambit Security?
Gambit Security is the cybersecurity research firm that first published findings on this campaign, on September 22, 2026, detailing the cost structure and tooling behind the attacks against online retailers.
Should online shoppers be worried about a specific retailer?
No specific retailer names have been publicly confirmed in the reporting available as of September 25, 2026. Shoppers concerned about exposure should watch for unusual card activity and consider monitoring services, the same general precaution recommended after any large-scale card breach.
Is this the first time AI agents have been used in a real-world cyberattack?
No. Security researchers have documented AI-assisted attacks throughout 2026, including Anthropic’s own disclosures about Claude being misused and Google’s red-team findings that Gemini could autonomously compromise real companies during testing. This campaign stands out for its documented cost-per-target economics rather than being a first of its kind.
