Dating note: Gambit Security published this on September 22, and The Next Web covered it on September 28. I’m catching up because it’s the clearest public example so far of off-the-shelf agent tooling used for crime at scale, and this blog covers that tooling. I’m relying on The Next Web’s summary. TNW hasn’t independently verified the findings. Gambit says it recovered the attacker’s staging server and rebuilt the campaign from its logs and stolen data.

I’m deliberately leaving out anything operational. The point here is the economics and the defensive lessons.

What Gambit reports

  • At least 27 companies breached, with named victims including a Fortune 500 hospitality company, a major US airline, an industrial-supplies distributor and an online fashion retailer.
  • More than 600,000 credit card records stolen, mostly traced to two companies, with 79% of the cardholders in the US.
  • Card skimmers were confirmed at 19 named victims, and Gambit found skimmers on more than 100 other websites.
  • The operator launched 105 attack projects between September 10 and 15 alone.

The tools

According to TNW’s summary:

  • Strix, an open-source penetration-testing tool, ran vulnerability scans, first on Z.ai’s GLM 5.2 and later on DeepSeek V4 Pro.
  • Cairn, an autonomous pentest agent, ran attacks end to end on DeepSeek V4.1 Flash.
  • Hermes ran the campaign using Anthropic’s Claude Opus 4.6, with 121 skills, 78 of them for attacks. The name and “skills” wording resemble Nous Research’s open-source agent, which I covered in the Nous funding post, but the summary I read doesn’t confirm that, so I won’t assume it.
  • The operator reached the models through OpenRouter.

The cost numbers

  • The operator’s OpenRouter account spent $7,005.71 over four weeks. Gambit estimates the full campaign cost $12,000 to $18,000.
  • A completed scan averaged $25.46, ranging from $3.13 to $79.31.
  • The operator typed 1,951 prompts across 260 sessions, which Gambit says is only a few prompts per target.

Attribution and limits

The staging server loaded a persona called “SOUL – Red Team Operator,” and the operator’s short instructions were in Chinese. Gambit does not link the campaign to a named group or country. And since this is a vendor reconstruction, the costs and scale are Gambit’s estimates.

One detail worth noting: at a bicycle retailer, the agents’ cleanup routines reportedly dropped 180 database tables, including backups. Automated attackers don’t just steal. They break things carelessly.

What I take from it

Three points, all mine rather than Gambit’s:

  1. The barrier was cost and skill, and both fell. Twenty-five dollars per target is a different threat model from a skilled human spending days.
  2. The entry points were boring. Skimmers hid in widely used JavaScript libraries, Google tags and containers. If you run a site, audit third-party scripts and watch for unexpected changes on checkout pages. A content security policy and subresource integrity help.
  3. “Open-source agent” is not the problem and not the solution. The same tools defenders use for testing did this. TNW lists no defensive recommendations, so for general guidance on agent security see my Kaspersky guidelines post.

Source: The Next Web.