Gambit Security Report: AI Agents Stole 600,000 Credit Cards From Retailers for $25 a Target

Since Gambit Security disclosed the campaign on September 22, the headline number has stayed fixed at 27 companies compromised in a single five-day window, but follow-up reporting from Forbes, Cyberpress, BleepingComputer and Quartz has filled in how cheap, fast, and hands-off the operation actually was.

Gambit's Threat Intelligence team found the campaign by accident, gaining access to an exposed staging server the attacker was using to run the operation. From the logs on that server, Gambit's Director of Threat Intelligence Eyal Sela reconstructed a campaign that ran from July 2026 through at least September 22, with the human operator typing just 1,951 short prompts across 260 sessions, according to Forbes.

Three Tools, One Assembly Line

The attacker chained together three open-source AI agent frameworks. Strix handled reconnaissance, running 146 deep-mode scans against 138 hosts between August 23 and 31 and logging 633 hours of scanner time in under 195 hours of clock time, according to Cybersecurity News. Cairn took a target and an objective, such as "get admin access," and worked unattended for hours until it succeeded or timed out. Hermes ran orchestration and post-exploitation, carrying a red-team persona called "SOUL," 121 skills including 78 offensive ones, and a custom skill built to strip out its own safety filters, according to BleepingComputer.

Model choice mattered. Strix ran on the Chinese open-weight model GLM 5.2 and DeepSeek v4 Pro, Cairn ran on DeepSeek v4.1 Flash, and Hermes ran on Anthropic's Claude Opus 4.6, an older model the operator settled on only after newer Claude releases refused the requests, according to Cybersecurity News. Anthropic told Quartz it identified and banned the account tied to the attacks.

The Economics

An OpenRouter account snapshot showed $7,005.71 in model spending over a roughly four-week window as of August 25, according to BleepingComputer and Cyberpress. Cybersecurity News and Cyberpress put the full campaign cost at an estimated $12,000 to $18,000. Across 101 completed scans, the operator's own cost tracking put the mean at $25.46 per target, ranging from $3.13 to $79.31.

Quartz, citing Forbes, reported a lower total outlay of "around $8,000" for the same campaign. That figure does not match the $12,000-to-$18,000 range other outlets built from the same OpenRouter snapshot, and neither Forbes nor Quartz explained the gap in the sourced material.

The Damage

Between September 10 and 15 alone, the operator launched 105 attack projects and compromised at least 27 companies, including a Fortune 500 hospitality firm, a major U.S. airline, an industrial supplies distributor, and an online fashion retailer, according to Gambit's own report. More than 600,000 valid credit card records were taken from two of those companies. Anti-fraud firm Overwatch Data analyzed the haul and found the records were unique and legitimate; about 79%, or roughly 488,000 cards, were U.S.-issued, per Cyberpress. A payments processor's spot-check found fewer than four in ten sampled cards carried any prior fraud flag, according to Forbes.

Skimmer code turned up on at least 119 websites across the full campaign, with 19 confirmed still active and roughly 100 more identified through partner research, according to Cyberpress and BleepingComputer. Injection methods included appending loader code to legitimate JavaScript files, poisoning S3-backed CDN buckets, altering Kubernetes deployments, and a cron job that restored a skimmer every two minutes after it was wiped, per BleepingComputer.

In at least one documented case, a Hermes skill file instructing the agent to "wipe the source fields in batches" after extracting card data matched too broadly against table names, dropping 180 tables at a bicycle retailer and destroying the victim's own backups, according to Cyberpress.

The Counter-Argument

A reasonable skeptic could point out that none of the individual techniques here are new. SQL injection, skimmer scripts, and S3 misconfigurations have been standard attack methods for years, and a human operator was still typing instructions and steering the campaign, even if briefly. Gambit is a commercial security vendor with an incentive to frame the threat in the starkest terms possible.

The raw scale is hard to dismiss. Gambit backed its numbers with direct evidence pulled from the attacker's own server, live skimmers it verified in the wild, and a cost accounting the operator kept for their own records. Cloudflare confirmed to Quartz that it is working with Gambit and the Shadowserver Foundation to take down the attacker's infrastructure, and Anthropic independently confirmed banning the account tied to the campaign, corroborating Gambit's account from two separate companies with no stake in the report's headline numbers.

The campaign was still described as ongoing as of the September 22 disclosure. Gambit says it continues notifying affected companies, and it remains unclear how many of the roughly 100 additional infected sites identified through partner research have been cleaned up or even contacted.