AI agents hacked hundreds of retailers autonomously at $25 per company
xeophon · x · 2026-09-22
Gambit Security uncovered an ongoing criminal campaign using open-source autonomous pentesting harness Cairn and other AI agents against hundreds of online retailers. Key facts:
- 105 attack projects launched Sept 10–15 alone; at least 27 companies compromised; activity traces back to July 2026
- At least 600,000 unexpired credit card records stolen from two companies; card-stealing skimmers on five sites; victims include a Fortune 500 hospitality firm and a major US airline
- Breaches often took under a day, sometimes hours; agent cleanup routines even destroyed victim data
- Marginal cost: tens of dollars per target
A landmark case of AI agents weaponized for large-scale cybercrime.
More from AGI Musings
- Prediction: hospitals will keep their own tested open-model formularies in two years — MaziyarPanahi · 2026-11-12
- Packy revives Qwest CEO's 1998 'no bandwidth glut' quote for the AI oversupply debate — prestonpesek · 2026-11-12
- Stanford's James Zou joins The Economist podcast on AI agents in science — anshulkundaje · 2026-11-12
- a16z maps the B2A economy: AI agents are now most of web traffic and soon its buyers — venturetwins · 2026-11-12
- Jason: Anthropic is rebuilding every SaaS product into Claude—free for life — smtabatabaie · 2026-11-12
- Fleuret: if AI designs drugs as fast as it makes dumb videos, regulation will buckle — francoisfleuret · 2026-11-12