Gambit Security reconstructed an autonomous AI agent campaign that used three open-source tools — Strix, Cairn, and Hermes — to breach more than 100 online retailers, steal over 600,000 credit card re…
Gambit Security reported that a financially motivated attacker used three AI agent tools — Strix for vulnerability scanning, Cairn for objective pursuit, and Hermes for coordination running Anthropic'…
Gambit Security recovered a staging server used in the first documented large-scale autonomous AI agent breach campaign, which compromised at least 27 organizations since July 2026 and exfiltrated mor…
A Chinese-speaking operator used three open-source agent harnesses — Strix, Cairn, and Hermes — to compromise at least 27 companies between September 10 and September 15, 2026, according to incident-r…
Gambit Security reported an ongoing campaign in which human-directed autonomous AI agents named Hermes, Strix, and Cairn automated multi-stage breaches of online retailers, deploying payment skimmers …
A financially motivated threat actor used three open source AI harnesses — Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes for orchestration — to breach hundreds of onlin…
Gambit Security found an exposed Aurora ransomware command-and-control server containing 28 chat logs showing an operator using Cursor Agent, powered by Anthropic's Claude Sonnet, to conduct post-comp…
An affiliate of the Aurora ransomware operation used Cursor's agentic coding assistant, running Anthropic's Claude Sonnet, to conduct hands-on network exploitation against at least ten organizations b…
Russian-speaking hackers used Cursor, the AI coding assistant made by Anysphere, to breach at least six companies, including Christeyns, Teckentrup, Helideck Certification Agency, Bayou Title, an Arge…
Russian hacking group Aurora has used SpaceX's AI coding assistant Cursor, running Claude Sonnet, to conduct cyberattacks against at least seven companies, including a Belgian chemical firm, according…
Russian-speaking cybercriminals used Cursor's AI agent to attack seven companies after telling it their activity was an authorized security test, according to cybersecurity firm Gambit Security and a …
Gambit Security's threat intelligence report reveals an AI-driven ransomware attack where an affiliate of The Gentlemen ransomware-as-a-service group used Anthropic's Claude Code (Claude Sonnet 4.6) t…
Gambit Security researchers found that cyber attackers are using AI tools to write malicious code, harvest credentials, search compromised networks, identify valuable business information, manage tech…
Dragos reported that an unknown adversary used Anthropic's Claude and OpenAI's GPT models to target a Mexican municipal water utility's operational technology (OT) environment during a campaign betwee…
Five Eyes intelligence agencies warned that frontier AI could transform cyber offense and defense within months, not years, urging organizations to embed cyber resilience as a core business priority. …