An operator used AI agents on Claude Opus 4.6, GLM 5.2 and DeepSeek to compromise 27+ companies and take 600,000+ card records, Gambit says
An operator ran three open-source AI agent harnesses, on Claude Opus 4.6, GLM 5.2 and DeepSeek models, against online retailers and other companies, compromising at least 27 of them and stealing more than 600,000 card records from two. At one retailer an agent's cleanup step dropped 180 database tables, including the victim's own backups.
An operator ran an automated campaign against online retailers and other companies using three open-source AI agent harnesses. Between 10 and 15 September 2026 alone, it launched 105 attack projects and compromised at least 27 companies to varying degrees; the activity goes back to July 2026. Gambit Security reconstructed the campaign from the operator's staging server1. Victims included online retailers and, to some degree, a Fortune 500 hospitality company, a major US airline and an industrial supplies distributor1.
Each harness ran on a different model. Strix searched for vulnerabilities on GLM 5.2 and later DeepSeek v4 Pro, and Cairn carried out end-to-end exploitation on DeepSeek v4.1 Flash1. Hermes, the operator's console, ran on Anthropic's opus-4.6 "after newer models refused its requests." The operator loaded it with a "SOUL - Red Team Operator" persona, 78 attack skills and a skill meant to remove Hermes's own content security filters12. The human typed only a few prompts per target1.
The agents stole more than 600,000 unexpired card records from two companies. One skill told the agent to wipe the card data from a victim's database after extracting it. At a bicycle retailer, an agent's cleanup step matched table names too broadly and dropped 180 tables, including backups the victim's administrators had made1.
The campaign was cheap to run. An internal review on the operator's server put the mean cost at $25.46 per completed scan, and Gambit estimates total model spend at $12,000 to $18,00013.
Between September 10 and September 15, 2026, an operator launched 105 attack projects and compromised at least 27 companies to varying degrees.
“Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees.”
Gambit says the operator had some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer.
“some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer”
The threat actor exfiltrated more than 600,000 credit card records from two victim companies.
“The threat actor exfiltrated more than 600,000 credit card records from two victim companies.”
The operator used three AI harnesses: Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes to orchestrate the campaign.
“The operator used three AI harnesses: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign”
Hermes used Anthropic's Claude opus-4.6 after newer models refused the operator's requests.
“It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions”
The operator loaded a system persona titled "SOUL - Red Team Operator", 78 attack skills, and a skill to remove Hermes's content security filters.
“On this server it loaded a Chinese system persona titled “SOUL - Red Team Operator”, 121 skills of which 78 were attack skills. The operator also added a skill whose purpose is to remove the content security filters of Hermes itself.”
Strix ran vulnerability scans through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro.
“Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro.”
DeepSeek v4.1 Flash was used to drive autonomous penetration testing in the Cairn harness.
“DeepSeek v4.1 Flash was used in the Cairn attacks.”
An agent's cleanup routine dropped 180 tables matching staging prefixes at a bicycle retailer, impacting backup tables created by the victim's administrators.
“the cleanup then dropped 180 tables whose names matched ZQ or Backup, which also impacted backup tables that the victim’s administrators had made.”
A Hermes skill titled "Database Wipe After Extraction" instructed the agent to wipe card data fields from Magento databases once data was extracted.
“One of the Hermes agent’s skill files tells the agent to erase the card data from the victim’s Magento database once the data is stolen.”
The operator accessed models through OpenRouter, with estimated total model costs between $12,000 and $18,000.
“so the full cost was likely between $12,000 and $18,000.”
An internal review on the attacker's server calculated a mean cost of $25.46 across 101 completed scans, ranging from $3.13 to $79.31 per target.
“a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.”
Measurements
Unexpired credit card records stolen1
Scan cost per target1
Table
| Item | Value |
|---|---|
| Mean scan cost | $25.46 |
| Minimum scan cost | $3.13 |
| Maximum scan cost | $79.31 |
Tables dropped during agent cleanup1
Estimated total OpenRouter API spend1
Table
| Item | Value |
|---|---|
| Lower estimate | $12K |
| Upper estimate | $18K |
All 13 claims with their quotes
- Between September 10 and September 15, 2026, an operator launched 105 attack projects and compromised at least 27 companies to varying degrees.12
“Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees.”
- The activity goes back to July 2026.1
“The activity goes back to July 2026”
- Gambit says the operator had some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer.1
“some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer”
- The threat actor exfiltrated more than 600,000 credit card records from two victim companies.12
“The threat actor exfiltrated more than 600,000 credit card records from two victim companies.”
- The operator used three AI harnesses: Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes to orchestrate the campaign.123
“The operator used three AI harnesses: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign”
- Hermes used Anthropic's Claude opus-4.6 after newer models refused the operator's requests.1
“It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions”
- The operator loaded a system persona titled "SOUL - Red Team Operator", 78 attack skills, and a skill to remove Hermes's content security filters.12
“On this server it loaded a Chinese system persona titled “SOUL - Red Team Operator”, 121 skills of which 78 were attack skills. The operator also added a skill whose purpose is to remove the content security filters of Hermes itself.”
- Strix ran vulnerability scans through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro.1
“Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro.”
- DeepSeek v4.1 Flash was used to drive autonomous penetration testing in the Cairn harness.1
“DeepSeek v4.1 Flash was used in the Cairn attacks.”
- An agent's cleanup routine dropped 180 tables matching staging prefixes at a bicycle retailer, impacting backup tables created by the victim's administrators.12
“the cleanup then dropped 180 tables whose names matched ZQ or Backup, which also impacted backup tables that the victim’s administrators had made.”
- A Hermes skill titled "Database Wipe After Extraction" instructed the agent to wipe card data fields from Magento databases once data was extracted.12
“One of the Hermes agent’s skill files tells the agent to erase the card data from the victim’s Magento database once the data is stolen.”
- The operator accessed models through OpenRouter, with estimated total model costs between $12,000 and $18,000.1
“so the full cost was likely between $12,000 and $18,000.”
- An internal review on the attacker's server calculated a mean cost of $25.46 across 101 completed scans, ranging from $3.13 to $79.31 per target.123
“a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.”
Sources
- [1]Autonomous AI agents and online retailers: $25 a company
- [2]Open-source AI agents breach credit card records
- [3]AI tools help hacker break in for $25 per target
Related incidents
- AID-2026-0099 A cybercriminal had an AI coding agent build the intrusion tools for an invoice-fraud campaign against Brazilian companies, SOCRadar finds
- AID-2026-0066 ShinyHunters-affiliated crews used Claude to breach companies and steal data for extortion (Anthropic GTG-50014)
- AID-2026-0067 Espionage actor GTG-20006 automated intrusions with Claude Code and exfiltrated over 300,000 identity records
- AID-2026-0068 An actor used the agentic pentest tool ARTEX and Claude Code to breach South Korean financial organizations, CrowdStrike reports
Editor notes
Gambit Security published an interim threat intelligence report based on forensic analysis of the attacker's staging server. Gambit noted that investigations were in an early stage and actual figures may be higher. The primary report contains conflicting statements regarding skimmer injections, mentioning five in the executive summary and 19 confirmed out of 27 targeted in a later section; secondary reports by CSO Online cited five. Only Gambit named the specific underlying foundation models; secondary outlets named only the agent harnesses. No victim or model vendor responses are reported in the sources read. CSO Online and Hackread name only the harnesses, not the underlying models.