AI agents breached 27 companies and stole 600,000 cards. The playbook is open source.

Gambit Security recovered the staging server of a financially motivated attacker and used it to reconstruct an attack campaign built almost entirely on open-source AI agent tooling. Between September 10 and September 15, the operator launched at least 105 attacks, according to Gambit's account of the campaign as reported by The Register. At least 27 companies were compromised "to varying degrees," including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Gambit has not named the victims, and neither do we.

The attack chain

The attacker used three open-source AI harnesses, each with a different job. Strix handled vulnerability discovery, run through OpenRouter first on GLM 5.2 and then on DeepSeek v4 Pro. Between August 23 and August 31, it ran 146 times in "deep mode" against 138 hosts, accumulating 633 hours of scanner time inside 195 hours of clock time. The parallelism is the point: no human sustains that tempo.

Strix handed off to Cairn, an autonomous exploitation tool running on DeepSeek v4.1 Flash. Cairn received a target domain and an objective, such as deploying a shell or gaining admin access, and ran until it achieved it, timed out, or was stopped by a human. Note the name collision: this Cairn is unrelated to an AI malware-analysis tool Cisco Talos released around the same time, per Merchant Fraud Journal's reporting on the Gambit findings.

Over both sat Hermes, an orchestrator loaded with a Chinese system persona titled "SOUL - Red Team Operator" and 121 skills, 78 of them attack skills. One skill existed to strip the content safety filters from the harness itself. Gambit reports Hermes ran on Anthropic's Claude Opus 4.6, and that newer models refused the attack requests.

The human was the least busy part of the operation. The operator typed 1,951 short prompts in Chinese across 260 sessions: check the file upload for code execution, test the sudo password first, get into the web backend. Gambit's director of threat intelligence, Eyal Sela, described the harnesses as running "at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs."

What the agents did with access

In one intrusion documented by Gambit, the agent chained an unauthenticated SQL injection flaw into a plaintext one-time password, accessed a web panel, uploaded a web shell, escalated privileges through a misconfigured sudo rule, and reached AWS credentials, ultimately dumping 46 secrets totaling 102KB. A corroborating account adds a variant that ran from SQL injection through MFA bypass, administrative access, arbitrary file upload, privilege escalation, NFS access, WordPress compromise, AWS Secrets Manager extraction, and a Magento database containing encrypted payment data. The attack paths differed across victims: the AI chose them in real time through probing, producing mostly different tactics per target.

In two of these near-autonomous attacks, the agents exfiltrated more than 600,000 unexpired credit card records from just two victim companies.

Skimmers were a primary goal. Gambit says skimmer deployment was ordered against at least 27 named victims, with scripts confirmed present on 19 websites. The most common technique was appending code to an existing JavaScript file. Others included modifying legitimate JavaScript bundles, injecting foreign script tags, poisoning S3-hosted content, altering database fields, modifying Kubernetes deployments, and planting cron jobs that restored the malicious code after legitimate deployments removed it. Working with security researcher Varys, Gambit also identified more than 100 additional websites carrying infrastructure-linked skimmer code.

The economics

The detail that changes the shape of this crime is the price. An August 25 OpenRouter account balance showed $7,005.71 spent over the prior four weeks. The operator then kept going for three more weeks at twice the daily call volume. Gambit estimates the total campaign cost at $12,000 to $18,000. The operator's own cost review put mean spend at $25.46 across 101 completed scans, with the cheapest scan at $3.13 and the most expensive at $79.31.

There is a destructive footnote. Gambit says the attacker's playbook contained instructions that could disrupt company operations through data deletion or cleanup procedures run by the agent, and that this happened in some breaches. One Hermes skill instructed the agent to erase payment-card data from Magento databases after exfiltration. At one victim, a bicycle retailer, an overly broad cleanup routine reportedly dropped 180 database tables, including administrator-created backups. The agents were not careful about what else they destroyed.

Why it matters for agent operators

Every tool in this campaign is downloadable. The cost figures put the entire operation within reach of a single person with a credit card. Sela's warning is about time: where access was achieved, it usually took less than a day, and in many cases just a few hours. "When exploitation arrives within hours of exposure," he said, "patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back."

The uncomfortable mirror is your own deployment. The same capabilities the attacker used are the ones legitimate operators give their agents: shell access, AWS credentials, database rights, the ability to run long unattended loops. The difference is permission boundaries and oversight, and this campaign is a stress test of both.

What to take from it as operator guidance, not fear:

Bound the blast radius before you automate. An agent that can run shell commands, read cloud credentials, and write to databases should hold the minimum privileges its task requires, with its own scoped tokens rather than the operator's. OWASP's prompt-injection prevention guidance says the same thing from the other side: restrict the agent to the minimum access necessary for its intended operations.

Keep a human in the loop on destructive and irreversible actions. Deletion, mass exfiltration, and persistence should require approval or hard policy limits, not the agent's judgment. Gambit's campaign shows cleanup routines deleting 180 tables when left unsupervised.

Monitor egress and behavior, not just signatures. The exfiltration here moved at machine speed across dozens of targets. Log agent activity, alert on anomalous tool-call sequences, and watch for new persistence mechanisms like the cron jobs that reinstalled skimmers after removal.

What remains unknown

The operator is unidentified. The research describes a Chinese-speaking individual acting for financial gain. No nation, company, or person is named, and none should be inferred.

Everything above rests on Gambit's reconstruction of the operator's staging server, as reported by press outlets. Those numbers have not been independently verified. "Compromised to varying degrees" leaves the depth of each breach unspecified, and the 27-company count covers a five-day window of a campaign active since at least July.

Whether the campaign is still running is unresolved. One account says it remained active as of September 22, 2026. Gambit worked with industry partners on victim notification and infrastructure takedown, but the current operational status is not public.

Finally, the model detail deserves care. Gambit reports that Hermes ran on Claude Opus 4.6 and that newer models refused the attack requests. How refusal was tested, across which models, and whether refusals held under varied prompting is unspecified. Treat it as a single research observation, not a claim about model safety in general.