Meta News

A financially motivated threat actor is using autonomous AI agents to automate large parts of real-world cyberattacks, compromising online retailers and stealing hundreds of thousands of payment card records.

Security firm Gambit says the campaign has been active since July 2026 and is operated by a Chinese-speaking attacker. Rather than relying on a single AI system, the operation combines three open-source AI frameworks to handle vulnerability discovery, exploitation and attack orchestration.

Between September 10 and 15 alone, the attacker launched 105 attack projects, compromising at least 27 organizations to varying degrees. Some successful intrusions reportedly took only a few hours.

The operation uses different AI tools for different stages of the attack chain.

The first is Strix, an open-source AI penetration-testing tool. The attacker used it for reconnaissance and vulnerability discovery, running 146 deep scans against 138 hosts between August 23 and 31.

Those scans used models including GLM 5.2 and DeepSeek v4 Pro through OpenRouter.

Reports generated by Strix were then passed to Cairn, another autonomous penetration-testing system. Cairn handled active probing and exploitation, dynamically deciding which attack paths to attempt based on what it discovered.

Gambit found that the techniques differed substantially between victims because the AI was selecting actions in real time rather than executing the same predefined script against every target.

The third component was Hermes, an autonomous agent equipped with persistent memory, reusable skills, searchable previous sessions and scheduled jobs.

The attacker configured Hermes with 121 skills, including 78 focused on offensive security, and used Anthropic’s Opus 4.6 model for orchestration, tactical decisions and direct hacking activities.

One of the most significant findings was how little direct human interaction the campaign required.

Researchers recovered 1,951 human-written prompts across 260 sessions. Most were short instructions in Chinese telling the agent to begin attacking a target, continue to the next stage or decide what to do after obtaining access.

In other words, the human operator primarily provided objectives while the agents handled much of the technical work.

This is an important distinction from simply using ChatGPT to generate malicious scripts. The AI systems were actively probing targets, interpreting results and adapting their attack strategies.

The consequences were substantial.

Gambit says attackers obtained information associated with more than 600,000 unexpired payment cards from two companies, including over 488,000 cards belonging to U.S. customers.

The attackers also gained some level of access to a Fortune 500 hospitality company, an airline, an industrial supplies distributor and an online fashion retailer.

In some cases, the agents went beyond stealing information.

Researchers discovered a Hermes skill designed to delete stolen payment card information from a victim’s Magento database. At another retailer, the agent deleted backup tables after the human operator instructed it to remove staging data created during the intrusion.

This suggests the agents were being used not only for exploitation but also for operational cleanup.

Another major objective was compromising online checkout systems.

Attackers injected JavaScript payment skimmers into ecommerce websites so that customers entering payment information could unknowingly send their card details to the attackers.

The skimmers were deployed through several different techniques depending on the target.

Malicious code appeared inside existing JavaScript files, HTML script tags, Google Tag configurations, AWS S3 buckets, database fields, Kubernetes initContainers and cached checkout-page models.

The variation illustrates the advantage of autonomous exploitation: rather than requiring the attacker to manually adapt a payload for every environment, the agent could investigate the target and select an appropriate persistence technique.

At one U.S. retailer, legitimate application redeployment repeatedly removed the malicious checkout code. The attacker responded by creating a cron job that checked the file every two minutes and automatically restored the skimmer whenever it disappeared.

Researchers ultimately identified more than 100 websites infected with skimming code.

Perhaps the most important finding is the economics of the operation.

The attacker relied heavily on open-source tooling and relatively inexpensive model access. Gambit estimated that 101 completed vulnerability scans had an average cost of just $25.46 each.

This changes one of the traditional constraints on sophisticated cyberattacks: skilled human labor.

Previously, attacking hundreds of customized ecommerce environments required substantial time from experienced operators. Autonomous agents can now perform much of the reconnaissance and experimentation simultaneously while humans supervise the broader campaign.

The underlying attack techniques are not necessarily new. Vulnerability scanning, web exploitation, payment skimmers and database manipulation have existed for years.

What AI changes is the speed, adaptability and cost of performing them at scale.

Previous demonstrations of autonomous AI hacking largely came from controlled security evaluations. This campaign is different because researchers say the technology was deliberately deployed against real organizations for financial gain.

The human attacker has not disappeared from the process. They still select targets, establish objectives and occasionally provide tactical instructions.

But the balance of work is changing.

Instead of manually investigating every application, writing every exploit and adapting every attack, a human operator can increasingly supervise multiple autonomous systems capable of performing those tasks independently.

That could significantly lower the resources required to conduct large-scale cybercrime.

The campaign therefore provides an early example of what agentic cyberattacks may look like: humans choosing objectives while fleets of inexpensive AI agents perform reconnaissance, exploitation, persistence and data theft across hundreds of targets simultaneously.