Autonomous AI Agents Are Breaking into Online Retailers A financially motivated threat actor used three open source AI harnesses — Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes for orchestration — to breach hundreds of online retailers since July 2026, stealing at least 600,000 unexpired credit card records from two companies and injecting card-skimming scripts on five retailers' websites, according to an interim report from Gambit Security's Threat Intelligence team. Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised, with access typically achieved in under a day and sometimes hours, at a marginal cost of tens of dollars per company. The campaign also hit a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer, and the attacker's staging server showed $7,005.71 spent on OpenRouter AI model access as of 25 August 2026, with the agent's own cleanup routines destroying victim data in some breaches. A financially motivated operator is running three open source AI harnesses against hundreds of online retailers, almost entirely unattended. More than 600,000 credit card records have been taken, and in one case the agent's own cleanup routine destroyed the victim's data. A financially motivated threat actor is using open source AI harnesses to attack hundreds of online retailers, at a marginal cost of tens of dollars per company. Gambit Security's Threat Intelligence team recovered the operator's staging server and reconstructed the campaign from it. Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. The activity goes back to July 2026 and is still running. Three AI harnesses ran almost the entire attack chain autonomously, working up to tens of companies a day. The impact we can account for includes at least 600,000 unexpired credit card details from two companies, the installation of card-stealing skimmer scripts on the websites of five, and some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer. The campaign goes back further, and has impacted at least tens of other companies since July 2026. Where access was achieved, it usually took less than a day, and in many cases just a few hours. We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches. The following is an interim report of our findings. We base the claim of compromise and impact on three sources. First, direct evidence we found on the attacker’s staging server, such as the exfiltrated data itself and respective tooling. Second, live compromises we verified in the wild - skimmers that have been injected into websites and are still there, or have been removed since but logged in various scanners. Third, logs and AI claims found on the attacker’s server. While AI claims and reporting may turn out to be inaccurate, we rely on them in this report because we could verify substantial parts of the claims by the first two methods, which showed them to be accurate. Thus, in cases where we could not independently verify, we gave credence to the claims in combination with exploitation process logs such as logged success responses from servers or listings of accessed assets . Nevertheless, due to the scale, incomplete data and early stage of the analysis, a few errors or inaccuracies are possible. We estimate the actual size and impact of the campaign to be larger than we report here. This campaign showcases just how powerful attacks can be in 2026. At very low cost, the AI tools demonstrated a level of patience, persistence, and creativity that most human attackers would be unlikely to sustain in this kind of attack, and achieved far greater results, far faster. Organizations must adapt to a reality where attacks are significantly faster and more comprehensive by shifting to a resilience-first mentality and a security stack that matches the AI speed. We have reached out to many of the affected organizations and took measures to take down the infrastructure discovered. We would like to thank the Shadowserver Foundation, Daniel Gordon, and other industry partners for their quick help and availability in notifying impacted organizations, taking down infrastructure, and conducting research. The operator used three AI harnesses: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign, launch intrusion jobs, steer the activity and give tactical guidance in the impact and other stages. OpenRouter was used for AI model access. The capture of the account balance on 25 August 2026 records $7,005.71 US spent, for a period of four weeks. The operator then ran for three more weeks at about twice the daily volume of model calls, recorded in the agent logs, so the full cost was likely between $12,000 and $18,000. Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company. The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive. Hermes is an open source autonomous AI agent with a persistent memory, skills that the agent writes and edits itself, a searchable archive of past sessions, scheduled jobs and a web console. On this server it loaded a Chinese system persona titled “SOUL - Red Team Operator”, 121 skills of which 78 were attack skills. The operator also added a skill whose purpose is to remove the content security filters of Hermes itself. Hermes is the operator’s console for orchestrating the activity and for direct hacking activities. It used Anthropic’s opus-4.6 after newer models refused its requests , with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access. For example: Strix is an open source AI penetration testing tool. Between 23 and 31 August 2026 Strix was run 146 times in “deep mode” against 138 hosts, accounting for 633 hours of scanner time in 195 hours of clock time. Some of these reports were the opening of the next stage of the exploitation, handed over to Cairn. Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro. Cairn is an autonomous penetration testing engine. It receives target domains and an objective, such as to get a shell or admin access, then runs for hours until it achieves the objective, times out, or is stopped. DeepSeek v4.1 Flash was used in the Cairn attacks. Between 10 and 15 September, 105 attack projects were launched. The chart below shows the state of 48 of them. The other 57 were deleted and not available for analysis. Each attack path was chosen by the harness in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims. For example, the chain below was documented in one completed Cairn project: Unauthenticated SQLi login email param, error-based EXTRACTVALUE - OTP plaintext read from the OTP table MFA bypass - admin panel access - Arbitrary file upload image field, no extension check - host RCE uid=1001, gid=root - sudo NOPASSWD python3.12 - root - NFS mount internal address, no root squash - WP blog DB credentials from wp-config.php on NFS - WP admin write new user via DB - WP plugin upload - blog host RCE - AWS Secrets Manager full dump 46 secrets, 102KB - Main Magento DB access Aurora - Magento encryption key extraction - cc number enc Blowfish-ECB decryption verified The operator selected targets in several ways. One was a website traffic ranking service, where they chose the shopping category and filtered out the shops running the major hosted or open source commerce platforms, to keep the shops with custom code, which the attacker assumed were more likely to be vulnerable. They then pasted 301 results into the console with a message that ended with 跑这些 用代理 只扫高危 “run these, use the proxy, high severity only” . Others were picked by hand or by other means, such as a New Zealand retailer and a US photo printing company that they handed to the agent already holding a working administrator password, with the order 开干 “get to work” . The threat actor exfiltrated more than 600,000 credit card records from two victim companies. We partnered with Overwatch Data https://www.overwatchdata.ai/ , which specializes in fraud, to handle the compromised cards and notify the issuers. Their breakdown of the cards by issuing country: One of the Hermes agent’s skill files tells the agent to erase the card data from the victim’s Magento database once the data is stolen. The section is called Database Wipe After Extraction and it opens: “ After extracting and downloading all card data, wipe the source fields in batches ”. It describes an SQL query and tells the agent to “ Use chunked PHP script for the serialized-field wipe millions of rows with LIKE ‘%…%’ is slow in a single UPDATE ”, and ends with “ Verify after wipe: Run the detection query again - all counts must be 0. ” These instructions show the operator expected victims’ tables to contain millions of rows. At execution time, the operator gave the following instructions: 2026-09-14 16:31:18.732 先把rds1