The Incident: Scale, Duration, and Scope
Between September 10 and 15, 2026, a single Chinese-speaking cybercriminal directed artificial intelligence agents against more than 100 organizations over a five-day period. The operation, detected almost accidentally by threat intelligence firm Gambit Security, resulted in the compromise of at least 27 companies and the theft of over 600,000 credit card records.
The attacker accidentally left the infrastructure used to coordinate the attacks exposed on the internet, allowing researchers to reconstruct the operation. Among the victims are a Fortune 500 hotel multinational, a major US airline, and an online fashion retailer. The campaign, which began developing in July, remains active according to the latest reports, and the attacker has not yet been identified.
Key Data of the Incident Documented by Gambit Security
Summary of the technical and economic parameters of the attack.
| Parameter | Data |
|---|---|
| Main attack period | September 10-15, 2026 |
| Targets analyzed | Over 100 companies |
| Confirmed compromised companies | At least 27 |
| Credit cards stolen | Over 600,000 records |
| Average cost per target | $25.46 USD |
| Estimated total cost (4 weeks) | $7,000 - $8,000 USD |
Technical Methodology: How Autonomous Agents Operate
The attacker used a combination of commercial AI models, including DeepSeek v4.1-flash, Kimi (by Moonshot), and an earlier version of Claude (Opus 4.6) by Anthropic. These models were orchestrated using open-source tools like Cairn and Hermes, which allow coordinating multiple agents to execute complex tasks with minimal human intervention.
The methodology involved sending the agent a target URL and a brief instruction (less than 100 characters) to search for vulnerabilities. The agents demonstrated 'lateral thinking' capabilities: if a main access path was blocked, they analyzed digital records to trace the underlying infrastructure, identified exposed control panels, and exploited data processing flaws to execute malicious commands. Once inside, they installed 'skimmers' to steal card data and deleted backups and access evidence.
Automated Attack Flow by AI Agents
Sequence of actions executed autonomously by the agents according to the attacker's server logs.
- 01Reception of the target URL and vulnerability search instruction.
- 02Initial scan of the public application for known flaws.
- 03If the scan fails, analysis of digital records to map internal infrastructure.
- 04Identification of administration panels or APIs exposed on the internet.
- 05Exploitation of data processing vulnerabilities to achieve remote code execution.
- 06Installation of malicious code (skimmers) in payment forms.
- 07Mass extraction of credit card data.
- 08Deletion of backups and logs to hide the intrusion.
The Economic Factor: Minimum Cost, Maximum Impact
The most disruptive dimension of the case is the relationship between the attack cost and the value of the loot. Gambit Security calculated that the attacker spent approximately $7,000 on AI credits through the OpenRouter platform over four weeks, equating to an average of $25.46 per company analyzed. In comparison, the value of the 600,000 stolen card records, and the associated potential fraud, far exceeds that investment.
This low cost eliminates the barrier to entry for large-scale cybercrime. Until now, operations of this magnitude required specialized teams, weeks of reconnaissance, and custom tools. Now, a single person with a credit card and an API key can coordinate attacks that previously required a full group of experts. The campaign is estimated to have generated between $12,000 and $18,000 for the attacker, although the potential damage is much greater.
Impact on Defense: Why Traditional Tools Failed
Traditional defenses, designed for manual attacks or simple scripts, proved insufficient against the speed and adaptability of AI agents. The agents did not just execute predefined scripts; they interpreted results, changed strategy in real-time, and customized the attack for each target. This reduced detection and containment time, as the intrusion could be completed in hours.
Furthermore, the use of earlier Claude models (blocked in newer versions) and open-source Chinese models allowed the attacker to evade the stricter security restrictions of cutting-edge models. The combination of open orchestration tools and accessible models created an attack ecosystem difficult to block via simple blacklists, as the infrastructure could be reconfigured quickly.
Future Implications and Lessons for Cybersecurity
This incident marks the transition from AI-assisted to agentic AI in cyberattacks. The Spanish Data Protection Agency (AEPD) has noted that this requires explicitly incorporating AI-executed attacks into risk analyses, as they modify the probability, speed, and scope of incidents. Response times must be shortened, and human supervision must be supported by detection mechanisms capable of operating at machine speed.
For organizations, the lessons are clear: minimize the attack surface, protect identities and credentials, accelerate vulnerability management, and govern the use of AI agents. 'Agentic defense' becomes necessary to counter agentic offense. Additionally, regulation must address the offensive use of AI, ensuring that model providers implement effective controls against abuse, as Anthropic has done by blocking malicious accounts.
Recommended Actions for Organizations
Practical measures to mitigate the risk of attacks by autonomous AI agents.
| Area | Recommended Action |
|---|---|
| Risk Management | Explicitly include AI attacks in the risk analysis of data treatments. |
| Identity and Access | Implement multi-factor authentication and minimize permissions for credentials and API tokens. |
| Detection | Deploy real-time detection tools capable of identifying anomalous behavior patterns at high speed. |
| Infrastructure | Reduce the exposure of administration panels and APIs on the internet; segment the network. |
| Response | Automate containment and response to match the speed of offensive agents. |
Open questions
- The attacker responsible for the campaign has not been identified.
- It is unclear if funds were successfully withdrawn or if the stolen cards were used for purchases, although the data is authentic.
- The total scope of the campaign may be larger, as malicious code was found in over 100 additional stores.
- It has not been confirmed if the malicious activity has completely ceased, as the attacker has reactivated servers on several occasions.
Keep exploring
Sources consulted
Corrections and transparency
If you spot incorrect or outdated information, send us a correction with the page and source we should review.
Submit a correction