Gambit’s research on a September 2026 retail-compromise campaign exposes how AI orchestration commodifies large-scale attacks. The operation hit 119+ sites in five days, extracting 600k+ card records for roughly $25 per target. That math scales for any moderately-resourced attacker.
The technical stack (Claude for orchestration, GLM and DeepSeek for supplementary tasks, open-source harnesses for scanning and exploitation) is less interesting than the accessibility it enables. This wasn’t a technical breakthrough; it was malware wrapped in API orchestration. The bottleneck was always execution speed, and AI removes it.
The scarier finding: Gambit discovered this through reverse-engineering a staging server, not via live detection. If 100+ sites were compromised and nobody noticed until after the fact, that gap suggests this may be widespread and difficult to catch in real time.
Sources: AI Agents Are Hacking Online Retailers for $25 a Company
Coverage: Malicious AI Agents Steal 600K Credit Cards, Infect 100+ Sites with Skimmers
Related on this blog: [AUTO] Agent Security and the Vendor Incentive • [AUTO] Six hours to 23,800 stolen credentials • [QT] The AI Agent Security Threat: Serious Concern, Thin Evidence