Open-source AI agents used to breach 27 firms and steal card data

A single operator used three open-source AI penetration-testing tools to attack hundreds of companies and steal more than 600,000 credit card records, according to a report published by AI security company Gambit on 24 September 2026.

Gambit said it recovered the operator's staging server and used that access to reconstruct the campaign. Between 10 September and 15 September 2026, the operator launched at least 105 attacks and compromised "to varying degrees" at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote. Victims included a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer.

The operator, who Gambit describes as Chinese-speaking, used three open-source AI harnesses — software that lets a language model plan and run multi-step tasks on its own. Hermes acted as the orchestrator, running on Anthropic's Claude Opus 4.6. Gambit said newer models refused the attack requests. The operator loaded a Chinese system persona titled "SOUL - Red Team Operator" onto Hermes with 121 skills, 78 of them attack skills. One skill removed the harness's own content safety filters. The operator typed 1,951 prompts in Chinese across 260 sessions, including short instructions that translate as "Get into the web backend" and "Can it get code execution?"

Strix, an open-source penetration testing tool, did the vulnerability hunting, running through the OpenRouter model service on GLM 5.2 and then DeepSeek v4 Pro. Between 23 August and 31 August 2026, the operator ran Strix 146 times in "deep mode" against 138 hosts, totalling 633 hours of scanner time in 195 hours of clock time. Findings were handed to Cairn, another autonomous penetration testing tool running on DeepSeek v4.1 Flash, which takes a target domain and an objective such as deploying a shell, then runs until it succeeds, times out or is stopped.

Gambit said the attack paths were chosen by the AI in real time, producing different techniques across victims. In one case the agent used SQL injection, obtained a plaintext one-time password, accessed a web panel, uploaded a web shell, escalated privileges through a misconfigured sudo rule and reached AWS credentials, dumping 46 secrets totalling 102KB. Two victims alone lost more than 600,000 credit card records.

Installing card-skimming scripts on checkout pages was another goal. Gambit said the operator ordered skimmer deployment against at least 27 named victims, with scripts confirmed on 19 websites. Security researcher Varys helped detect more than 100 further infected sites linked to the campaign. The most common method was appending code to an existing JavaScript file.

The costs were small. An account balance dated 25 August 2026 showed the operator had spent $7,005.71 on model access over the previous four weeks, then continued for three more weeks at twice the daily volume of model calls. Gambit estimates the total campaign cost between $12,000 and $18,000. The operator's own cost review put mean spend at $25.46 across 101 completed scans, with the cheapest at $3.13 and the most expensive at $79.31.

Gambit also said it found instructions in the attacker's playbook that could disrupt company operations through data deletion or cleanup run by the agent, and that this had happened in some breaches. Where access was achieved, it usually took less than a day and often just hours, Sela wrote. "The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs," he said.