AI agents ran a card-skimming spree for $25 a company

Gambit Security has rebuilt an ongoing campaign in which one financially motivated operator used three open-source AI agent harnesses to break into hundreds of online retailers and take more than 600,000 unexpired card records from two of them. The company recovered the operator's staging server and reconstructed the work from it: the agent logs, the stolen data and the tooling left behind.

Three harnesses and a human giving short orders

The operator assembled a pipeline rather than writing attacks by hand. Strix, an open-source AI penetration testing tool, did the scanning. Between 23 and 31 August 2026 it was run 146 times in deep mode against 138 hosts, which worked out at 633 hours of scanner time inside 195 hours of clock time. Cairn took those findings and ran them to completion, receiving a domain and an objective such as a shell or administrator access, then working for hours until it succeeded, timed out or was stopped. Hermes sat above both as the console, carrying a Chinese system persona called SOUL - Red Team Operator, 121 skills of which 78 were attack skills, and a self-written skill whose purpose was to strip out its own content filters. It ran on Anthropic's opus-4.6 after newer models refused its requests. The human typed 1,951 prompts across 260 sessions, mostly short instructions such as read the vulnerability report and start.

What it cost, and what it took

Cost was not a barrier. Gambit found a captured account balance from 25 August 2026 showing $7,005.71 spent over four weeks, and estimates the full bill at between $12,000 and $18,000 once three further weeks of roughly doubled model traffic are counted. The operator's own cost review put the mean at $25.46 across 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive. Between 10 and 15 September, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. Where access came, it usually arrived in under a day and sometimes within hours.

How the skimmers landed

Card-stealing scripts were ordered against at least 27 named victims and confirmed in place on 19 of them, and Gambit says more than 100 further sites were found carrying a skimmer linked to the campaign, with help from the researcher Varys. The method was chosen to fit whatever access the agent had won. The most common was appending the loader to a legitimate JavaScript library the site already served and restoring the original file timestamp, so it reads as one more statement at the end of a jQuery or Bootstrap bundle. Others put a foreign script tag on a checkout page, hid the loader inside a site's Google tag block behind a hundred tab characters, poisoned an S3 bucket behind a store's content delivery network, wrote it into product description fields, pushed it through a Kubernetes initContainer, poisoned a server-side page cache and, at one wine retailer, left a cron job that checked the file size every two minutes and re-appended the skimmer whenever a redeploy removed it.

The data loss came from the attacker's own playbook

One of the agent's skill files is titled Database Wipe After Extraction and instructs it to empty the stolen columns in batches once the cards are downloaded, then check that the counts come back as zero. That instruction was carried out. At one retailer the agent also matched table names too broadly and dropped 180 tables, including backups the victim's own administrators had made. Gambit stresses that the report is interim, that some of it rests on the agents' own logs and claims, and that the real scale is likely larger. It has notified affected organisations alongside the Shadowserver Foundation and taken down infrastructure it found.

Our opinion

The figure that matters here is not 600,000. It is the mean of $25.46 a scan. Security budgets, alert thresholds and on-call rotas are all calibrated against an attacker who gets tired: patience runs out, mistakes pile up, interest moves on. An agent that can be handed a list of shops with the instruction to run the high-severity findings does not get bored, and the intrusion costs about what a takeaway does. The second lesson is quieter and nastier. The destruction was not extortion; it was housekeeping written into a skill file and executed without anyone choosing to hurt the victim, and a name-matching error took the backups with the target tables. Anyone planning only for theft will be caught out by that, which is why what a business can bring back now matters more than how fast it can close a door.