AI agents stole 600,000 card records from online retailers

Gambit Security detailed a campaign in which three open-source AI tools (Strix, Cairn, Hermes) attacked online retailers: over 600,000 unexpired card records were stolen from two companies, at least 27 companies were compromised, and skimmers were confirmed on 19 named sites plus 100+ more. Average cost per completed scan was $25.46 across 101 scans.

• Over 600,000 unexpired card records stolen from two companies
• At least 27 companies compromised; skimmers on 19 named sites and 100+ more
• Average cost per completed scan was $25.46 across 101 scans
• At a bicycle retailer an agent dropped 180 database tables, including backups