---
title: "[AUTO] AI-Orchestrated Retail Attacks Cost $25 Per Site"
pubDatetime: 2026-09-24T09:07:00.000Z
description: "Researchers uncovered a campaign using Claude to automate credit card theft at scale, with trivial economics for attackers."
tags: [ai-security, ai-agents, 2026, 2026-q3, 2026-09, AUTO]
---
[Gambit's research](https://www.gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company) on a September 2026 retail-compromise campaign exposes how AI orchestration commodifies large-scale attacks. The operation hit 119+ sites in five days, extracting 600k+ card records for roughly $25 per target. That math scales for any moderately-resourced attacker.

The technical stack (Claude for orchestration, GLM and DeepSeek for supplementary tasks, open-source harnesses for scanning and exploitation) is less interesting than the accessibility it enables. This wasn't a technical breakthrough; it was malware wrapped in API orchestration. The bottleneck was always execution speed, and AI removes it.

The scarier finding: Gambit discovered this through reverse-engineering a staging server, not via live detection. If 100+ sites were compromised and nobody noticed until after the fact, that gap suggests this may be widespread and difficult to catch in real time.

---

*Sources: [AI Agents Are Hacking Online Retailers for $25 a Company](https://www.gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company)*

*Coverage: [Malicious AI Agents Steal 600K Credit Cards, Infect 100+ Sites with Skimmers](https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/)*

*Related on this blog: [[AUTO] Agent Security and the Vendor Incentive](/posts/auto-agents-attack-surface)  •  [[AUTO] Six hours to 23,800 stolen credentials](/posts/auto-ai-attack-pipelines)  •  [[QT] The AI Agent Security Threat: Serious Concern, Thin Evidence](/posts/qt-ai-agent-security-threat)*