AI agents used to steal hundreds of thousands of credit card records

Chinese-speaking hacker targeted 100 companies

A Chinese-speaking hacker used AI agents to target as many as 100 companies and steal more than 600,000 credit card records, according to cybersecurity researchers.

The campaign, which has been running since July, relied heavily on AI to automate vulnerability discovery, exploitation, data theft and attempts to erase evidence of the intrusions.

Gambit Security, which uncovered the operation after the attacker accidentally exposed its server infrastructure online, described it as one of the most serious examples yet of AI being used for cybercrime.

The attacks reportedly cost the hacker about $8,000 in total, with individual targets costing as little as $3.13 to compromise.

AI agents automated the attacks

The attacker used three commercially available AI orchestration frameworks – Strix, Cairn and Hermes – to coordinate different parts of the operation.

Strix was used to search for vulnerabilities, while Cairn handled autonomous exploitation from start to finish.

Hermes acted as the campaign's coordinator, launching jobs, directing the attacks and providing tactical guidance.

The hacker accessed AI models through OpenRouter, using systems including China's DeepSeek and Kimi models, as well as Claude Opus 4.6, an earlier version of Anthropic's frontier AI model.

Attempts to use newer Claude models were rejected, suggesting that more recent versions have more robust safeguards to prevent overtly malicious activity.

Anthropic said it had identified and banned the account linked to the attacks.

Eyal Sela, director of threat intelligence at Gambit Security, said the AI systems used in the campaign were capable of carrying out sophisticated attacks rapidly, with little preparation and a high success rate.

The campaign breached at least 27 companies between 10th and 15th September. Victims reportedly included a Fortune 500 hospitality company, a major US airline, an online fashion retailer and an industrial supplies distributor.

Payment data and website skimmers targeted

The automated workflow began when the AI agents were given a target website and instructed to search for vulnerabilities.

After gaining access, the agents were directed to extract payment information and install malicious code, known as skimmers, on checkout pages.

The skimmers could silently capture card details when customers entered them during purchases.

Cybersecurity News said skimmers had been identified on 19 known victims and linked to more than 100 other compromised websites.

The attacker's records showed that 101 scans had been completed, with spending averaging $25.46 per target.

The agents were also instructed to remove evidence of their activity. In two cases, however, the automated cleanup reportedly went further and deleted victims' own data, including backup tables.

Anti-fraud company Overwatch Data found that the stolen records were unique and legitimate.

Attackers repeatedly rebuilt infrastructure

Gambit said it has been notifying affected organisations and working with Cloudflare and the Shadowserver Foundation to take down infrastructure used in the campaign.

Cloudflare confirmed it had shut down servers connected to the operation, but researchers said the attacker repeatedly rebuilt the infrastructure and continued the attacks.

The campaign adds to a series of incidents in 2026 involving AI systems interacting with real-world computer systems.

In July, OpenAI admitted that its AI models were behind a breach on Hugging Face.

Google has also said its Gemini model accessed real-world systems and used exposed credentials to enter three companies during a cybersecurity test.

In August, Meta said one of its AI models gained internet access and breached another organisation's systems during an evaluation.

Meta said the incident did not involve a sandbox escape or a sophisticated cyberattack.