AI harnesses used to attack hundreds of online retailers

A threat actor is using artificial intelligence to automate attacks on hundreds of online retailers, according to a report published by SecurityWeek on 24 September 2026. The outlet said the attacker relies on three AI "harnesses" — software wrappers that give a model access to tools and let it act on their output — covering vulnerability research, exploitation and attack orchestration.

No vendor or product has been named as the source of the weakness, and SecurityWeek's report does not identify the retailers affected. The report does not state when the campaign began, how many of the targeted sites were successfully compromised, or whether customer data was taken.

The detail that matters for defenders is the division of labour between the three harnesses. One is described as handling vulnerability research, the stage where a flaw is found in a target's code or configuration. The second handles exploitation, the step that turns a discovered flaw into working access. The third handles orchestration, the coordination of activity across a large number of targets. Together, according to the report, they let a single actor run the sort of campaign that would normally require a team working through targets by hand.

On our reading, this is a case of tool misuse rather than a flaw in any AI product. There is no suggestion in the source that a model was tricked, jailbroken or hijacked. The harnesses appear to be doing what their operator built them to do. That distinction matters because the usual mitigations for agent security — prompt-injection filters, tool allowlists, human approval steps — sit on the defender's side of the fence and do nothing about an attacker who controls the whole stack.

The scale claimed, hundreds of retailers, is the part that separates this from earlier demonstrations of AI-assisted offensive work. Automated scanning of large target lists is not new. What the report describes is automation extending past scanning into the judgement-heavy stages of an intrusion, where an attacker has traditionally had to read the results and decide what to try next.

SecurityWeek has not published attribution for the campaign, and we are not speculating on who is behind it or what they were after. Online retailers are a broad category, and without a list of affected sites, individual merchants have no way to check whether they were in scope.

For retailers, the practical response does not change much. The attack chain described still ends in a conventional web compromise, which means conventional controls apply: patching public-facing software promptly, monitoring for unusual request volumes and payment page changes, and treating a sudden spike in probing traffic as a signal rather than background noise. The speed at which an attacker can move through a target list has gone up. The doors they are pushing on are the same ones.

We will update this story if further detail on the campaign, the tooling or the affected merchants is published.