Crook used open-source AI agents to breach 27+ companies, steal 600k cards

A Chinese-speaking operator used three open-source AI penetration-testing harnesses (Strix, Cairn, Hermes) to autonomously scan and breach over 100 organizations between August and September 2026, compromising at least 27 companies including a Fortune 500 hospitality firm and a major US airline, stealing over 600,000 credit card records and deploying checkout-page skimmers on dozens of websites.

Occurred 10 September 2026 · Disclosed 24 September 2026 · Record updated 1 October 2026

Impact

At least 27 companies compromised, over 600,000 credit card records exfiltrated from two victims, and card-skimming scripts confirmed on 19 websites (with 100+ additional infected sites detected), across a campaign that ran with minimal human involvement.

Our coverage

Incidents

Open-source AI agents used to breach 27 firms and steal card data

AI security firm Gambit says one Chinese-speaking operator ran over 100 near-autonomous attacks in five days for less than $18,000.

25 Sept 2026

Sources

theregister.comhttps://theregister.com/security/2026/09/25/crook-used-three-open-source-agents-to-break-into-a-fortune-500-hospitality-company-a-major-us-airline-and-25-other-orgs/5299012