AI agent harnesses breach 27+ online retailers, steal 600,000+ card records
Gambit Security says a lone operator ran open-source AI agents almost unattended to hack hundreds of retailers for about $25 a target.
What to know
- A single operator used three open source AI harnesses to autonomously breach hundreds of online retailers at a marginal cost of tens of dollars per company.
- Between 10-15 September alone, 105 attack projects were launched and at least 27 companies compromised; the campaign has run since July 2026 and is still active.
- Confirmed impact includes over 600,000 unexpired stolen credit card records from two companies and card-skimming scripts installed on five retailer websites.
- In at least one case, the AI agent's own automated cleanup/data-deletion routine destroyed a victim's data, illustrating unintended operational risk from autonomous attack tooling.
Gambit Security Threat intelligence firm that authored the reportUnnamed threat actor Operator of the AI-driven attack campaignShadowserver Foundation Industry partnerDaniel Gordon Industry partner cited in the report
How it unfolded 2 developments, newest first · click a bar or a number to jump posts
-
2
Security community amplifies the findings
Infosec commentators and outlets including Packet Storm News share and repost the report, highlighting the roughly $25-per-target cost of the attacks.
“AI Agents Are Hacking Online Retailers for $25 a Company…”
— packet_storm@infosec.exchange -
B
"Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign": https:// gambit.security/blog-posts/aut onomous-ai-agents-online-retailers-25-a-company
-
-
1
Gambit Security publishes interim report on the campaign
Gambit Security says it recovered the operator's staging server and reconstructed the campaign, disclosing over 600,000 stolen unexpired card records from two companies, skimmers on five retailer sites, and access to a Fortune 500 hospitality company, a major US airline, an industrial supplies distributor and a fashion retailer.
“This campaign showcases just how powerful attacks can be in 2026.”
— Gambit Security -
P
AI Agents Are Hacking Online Retailers for $25 a Company https:// packetstorm.news/news/view/437 82 # news
-
-
background
Attack activity spikes, 27 companies compromised in five days — Between 10 and 15 September, the AI harnesses launched 105 attack projects and compromised at least 27 companies to varying degrees, working up to tens of companies a day.
-
background
Operator begins AI-driven retailer attack campaign — A financially motivated actor starts using three open source AI harnesses to autonomously attack online retailers, a campaign that continues into September 2026.