AI Agents Autonomously Hacked Hundreds of Firms, Stealing 600K Credit Cards for $8,000
Threat intelligence firm Gambit Security disclosed an ongoing large-scale criminal campaign: attackers used the open-source autonomous pentest harness Cairn and multiple AI agent toolchains to attack hundreds of online retailers with minimal human involvement, successfully breaching at least dozens of organizations and stealing roughly 600,000 valid credit cards. Average token cost per successful target was only about $25; per Forbes, the entire operation cost around $8,000 — widely regarded as the first large-scale proof of autonomous AI offensive capability.
Confirmed
- The campaign was financially motivated, targeting hundreds of organizations; at peak, up to 25 organizations were attacked simultaneously over several days, with the operation spanning days.
- Per Forbes as relayed by DavidSKrueger, a Chinese-speaking hacker attacked up to 100 organizations in 5 days using DeepSeek, Kimi, and an older Claude to automate the attack workflow, at a total cost of about $8,000.
- Average cost per successful target was about $25, with roughly 600,000 valid credit cards stolen.
Why it matters
- Security researcher Joshua Saxe argued this case is a concrete near-term signal of catastrophic AI cyber risk, warning that the security industry has grown numb to such warnings even though the direction is correct; former OpenAI policy lead Miles Brundage amplified the post, stressing Saxe is no "AI cyber doomer" and his alarm deserves attention.
- The case is the first to quantify how cheap and scalable autonomous AI attacks are — $25 per target and $8,000 total to obtain hundreds of thousands of card records — fundamentally changing the economics of cybercrime and forcing defenders to reassess their threat models.
2026-09-22 ~ 2026-09-24 · 6 related posts
Primary sources
- AI agents hacked hundreds of retailers autonomously at $25 per company — xeophon · 2026-09-22
- [source] AI Agents Breach Dozens of Orgs, Steal ~600k Credit Cards in First Scaled Agentic Cyberattack — deanwball · 2026-09-23
- AI Hackers at ~$25 Per Target: Joshua Saxe Warns Security Is Sleeping on Catastrophic Risks — joshua_saxe · 2026-09-24
- [source] AI agents let one hacker attack 100 orgs in 5 days for just $8,000 — DavidSKrueger · 2026-09-24
- [source] AI agents hacked 100 firms, stole 600k cards at $25 per target: security expert — joshua_saxe · 2026-09-24
1 near-duplicate retellings: joshua_saxe