On 22 September 2026 Gambit Security published a reconstruction of a campaign in which autonomous AI agents attacked online retailers. The researchers recovered the operator's staging server and rebuilt the campaign from the logs, the tooling and the stolen data sitting on it. The number that matters is not the 600,000 card records. It is the price per company.
Per Gambit, the operation averaged 25.46 dollars a target.
TL;DR
- Three open source agent harnesses split the work: Strix for scanning, Cairn for exploitation, Hermes for orchestration, all driven through commercial model APIs.
- Between 10 and 15 September alone, per the report, 105 attack projects ran and at least 27 companies were compromised to varying degrees. Skimmers were confirmed in place on 19 of them.
- Two targets were handed to the agent already holding a working administrator password. Where access succeeded at all, it usually took less than a day.
- A playbook step called "Database Wipe After Extraction" dropped 180 tables at one victim, backups included. This was an availability incident as much as a data theft.
#What Gambit recovered
The report is written by Eyal Sela, Gambit's director of threat intelligence, and its basis is unusual. Most agentic attack write-ups reason backwards from the victim. This one reasons forwards from the attacker's own machine, because the team recovered the staging server and read the campaign off it directly.
What that server held was a division of labour. Strix ran reconnaissance and vulnerability scanning, 146 runs in the documented period. Cairn handled exploitation and launched 105 attack projects between 10 and 15 September. Hermes sat on top as the orchestrator with persistent memory. All three are open source harnesses, and all three were pointed at commercial models through an API broker rather than anything self-hosted.
The human involvement is the part worth sitting with. Gambit counts 1,951 prompts across 260 sessions, written in Chinese, which works out to only a few prompts per target. One target was handed over with the instruction 开干, which translates roughly as "get to work".
The entry methods were not novel. SQL injection, file upload flaws, API abuse and stolen credentials, the same list a penetration tester would have written five years ago. Nothing here required a new class of vulnerability.
#What $25 a target changes
Gambit puts the model spend at 7,005.71 dollars over the first four weeks and estimates 12,000 to 18,000 dollars for the campaign as a whole. Against the number of targets, that is the 25.46 dollar average.
For years, the thing protecting an ordinary mid-sized company was not its controls. It was arithmetic. A skilled attacker's time was expensive, so somebody had to decide your company was worth a week of it. That filter is what most risk models quietly rely on when they rate a finding as low priority because nobody would bother.
Where access was achieved, it usually took less than a day, and in many cases just a few hours.
At 25 dollars and a few hours, nobody has to decide you are worth it. The attacker does not choose between you and a bank. They do both, in parallel, and read the results later. Every access path that was only theoretically exploitable is now economically exploitable, and that includes the service account nobody has owned since the person who created it left.
#The fastest targets came with a password
Two of the victims, a New Zealand retailer and a US photo printing company, were handed to the agent with a working administrator password already in hand. The agent did not have to find a way in. It started from inside.
That is the same ordering we saw in the Spanish regulator's first agent breach notification, where the login succeeded before any flaw was found, and in the PaperCut campaign, where a service account decided who lost the domain. Three separate reports, one pattern: the credential is not the last step of the attack, it is the first.
It is also the step that scales best for the attacker. An exploit has to be re-derived per target. A valid credential works the same way everywhere, needs no cleverness from the model, and costs nothing per use. When the expensive part of an intrusion becomes cheap, the parts that were already cheap become the whole plan.
#Anatomy of the path
# reconstructed by Gambit from the operator's staging server strix # 146 scanning runs, model-driven recon → cairn # 105 attack projects, 10 to 15 September → application # sql injection, uploads, api abuse, valid credentials → database # 600,000 unexpired card records from two companies → wipe # "Database Wipe After Extraction", 180 tables dropped
The last step deserves more attention than it has had. The playbook contained a skill for erasing the card data after stealing it. At one bicycle retailer the agent created its own staging tables with a ZQ prefix, then ran a cleanup that dropped every table whose name matched ZQ or Backup. That pattern caught the victim's backup tables too, 180 tables in total.
Read as a control failure, that is three incidents in one: a confidentiality breach, an integrity breach and a recovery problem, all caused by one identity that could read the card table, write new tables beside it and drop things. Most database accounts behind a web application can do exactly that, because splitting those rights was never worth the sprint it would have cost.
#What to check this week
- List the identities that can drop tables. Not the humans, the application accounts. In most shops the web application's database user owns its schema, which means it can also destroy it. Check whether yours needs that.
- Separate the backup path from the application identity. If the account the application uses can reach backup tables or backup storage, your recovery plan depends on the attacker not looking there.
- Find the credentials that would let someone start from inside. Admin passwords in shared vaults, integration accounts with static keys, old staff accounts still enabled. Two victims in this campaign began at that point.
- Re-rate your low priority findings. Anything marked low because exploitation was judged too laborious was rated under the old economics. Pull that list and read it again at 25 dollars a target.
- Alert on schema changes, not only on data volume. An agent creating staging tables inside your database is a loud signal that most monitoring ignores, and it happens before the exfiltration.
- Check how fast you would notice. Access here usually took hours. Ask what your mean time to detection is for a valid login from an unusual place, and whether anyone is awake for it.
- Write down who owns each machine identity. Every unowned service account is a target that now costs 25 dollars to try. The inventory is the cheap part. The blanks in it are the finding.
The tooling in this campaign is public, the models are rented by the hour and the vulnerabilities are the ordinary ones. What changed is the price of trying, and the price of trying is what your risk ratings were silently built on. Elmoz maps which of your non-human identities can reach the data that matters, and which of them can also delete it.