A financially motivated operator chained three open-source AI harnesses to compromise hundreds of e-commerce sites for roughly $25 each, exfiltrating over 600,000 card records. The interesting part isn't the theft — it's that the agent's own cleanup routine destroyed victim data, and that every control that failed here is a control most internal agent deployments also lack.
Last Updated: September 25, 2026
A financially motivated operator chained three open-source AI harnesses — Strix for scanning, Cairn for exploitation, Hermes for orchestration — to autonomously compromise hundreds of online retailers, exfiltrate more than 600,000 card records and plant skimmers on 100+ sites, at a mean cost of about $25 per target. The transferable lesson for anyone shipping agents isn't the skimmer. It's that the campaign's most destructive moment was an agent matching table names too broadly and dropping 180 tables, including the victim's own backups — the exact failure mode of an internal agent holding production credentials.
What was actually found
On September 22, Gambit Security's threat intelligence team published an interim report reconstructing an ongoing campaign from a staging server they recovered from the operator. BleepingComputer reported the findings the next day: activity dating to July 2026, still live as of September 22, with more than 600,000 unexpired card details taken from two companies and card-stealing scripts confirmed on the checkout pages of others. Victims include, per Gambit, a Fortune 500 hospitality company, a major US airline, a large industrial supplies distributor and an online fashion retailer.
The operator is described as Chinese-speaking, working through OpenRouter for model access, and issuing short instructions in Chinese between autonomous runs — 1,951 human prompts across 260 sessions, which works out to a handful of prompts per target. Coverage since has been broad and consistent, including SecurityWeek and TechRadar.
How the chain ran
Operator pulled the shopping category from a traffic-ranking service, filtered out major hosted platforms to keep shops running custom code, and pasted 301 results into the console.
Ran in deep mode via OpenRouter on GLM 5.2, later DeepSeek v4 Pro. Reports fed straight into the next stage.
Given a domain and an objective (get a shell, get admin), it ran for hours until it succeeded or timed out. One documented chain went SQLi → plaintext OTP read → MFA bypass → file upload → RCE → sudo to root → NFS → AWS Secrets Manager → Magento encryption key.
Persistent memory, self-written skills, scheduled jobs, web console. Loaded a “SOUL - Red Team Operator” persona with 121 skills, 78 of them attack skills.
Loader appended to a legitimate jQuery or Bootstrap bundle with the original timestamp restored; or hidden inside the Google tag block; or delivered by poisoning the victim's own S3/CDN. Then the card columns were emptied.
The economics are the story, not the malware
Magecart-style skimming is a decade old. The injection techniques here are recognisable: append to a served JS file, add a script tag at checkout, poison a CDN bucket, drop a cron job that re-appends the payload every two minutes when a redeploy cleans it. None of that is new tradecraft. Neither are the vulnerabilities — unauthenticated SQL injection, an image upload with no extension check, sudo NOPASSWD on python3.12, an NFS export with no_root_squash, database credentials sitting in wp-config.php.
What changed is the unit cost of applying that tradecraft to a target that was previously not worth a human's week. Gambit's reconstruction puts total model spend between $12,000 and $18,000 for the whole campaign. At that price, target selection stops being a filter. Everyone with custom checkout code is in scope, all the time, whether or not they're interesting.
Three things this changes if you run agents
Model-level refusal is one routing decision away from irrelevant
Gambit notes the orchestration harness settled on Anthropic's opus-4.6 after newer models declined the requests, while the scanning and exploitation stages ran on GLM and DeepSeek models — all through a single aggregator. If your AI safety posture assumes the frontier lab's refusal behaviour is a control, this campaign shows what an aggregator does to that assumption. The same is true defensively: an internal agent that can reach a router can reach whatever model the router exposes, including ones your policy never approved. Egress allow-lists at the network layer are the control that actually holds. Model choice is not.
Self-editing skill files are live, unreviewed code
Hermes writes and edits its own skills. The operator exploited that directly by adding a skill whose job was to strip Hermes's own content filters. Read that as a preview of your own stack: any agent framework with persistent, self-modifiable instructions has a mutable code surface that never passes through code review, and an attacker with a prompt-injection foothold edits behaviour rather than binaries. If your agents persist skills, memories or tool definitions, those artefacts need to live in version control with diffs and approvals — the same bar as application code. We treat this as a default in our automation engagements, not a hardening extra.
The destructive step was a bad string match, not a ransom note
This is the detail every engineering leader should sit with. One Hermes skill file instructed the agent to erase card data from the Magento database after exfiltration.
After extracting and downloading all card data, wipe the source fields in batches
— Hermes skill file recovered from the attacker's staging server, Gambit Security
At a bicycle retailer, the agent staged stolen data in tables it prefixed with ZQ, then ran a cleanup that dropped 180 tables matching ZQ or Backup — taking out backup tables the victim's own administrators had created. No ransom, no extortion negotiation. Just an over-broad pattern match executed at machine speed with write access.
Strip the attacker out of that sentence and you have a description of an ordinary internal agent incident: an autonomous process with production credentials, a cleanup task, and a matching rule nobody scoped tightly enough. The threat model and the reliability model converge here.
Giving an agent the same credential a human operator would use
It happens because it's fast. The service account already exists, it already works, and scoping a narrower one means a ticket with the platform team. So the agent inherits read-write on schemas it will never legitimately touch — and the blast radius of any bad instruction, injected or self-authored, becomes the blast radius of that credential.
What to actually do this week
| Control | What it would have stopped here | What it costs you |
|---|---|---|
| Subresource Integrity + strict CSP on checkout | Loader appended to a served jQuery/Bootstrap bundle; foreign script tags on payment pages | A release-process change; breaks sloppy third-party tags, which is the point |
| File integrity monitoring on served JS, timestamp-independent | The re-appending cron job that restored the skimmer every two minutes after redeploys | Low; noisy until you baseline your build output |
| Egress allow-listing for agent runtimes | Aggregator access to unapproved models; DNS and HTTP exfiltration paths | Real engineering work, and the single highest-leverage item on this list |
| Scoped, short-lived credentials + tool allow-lists | Secrets Manager full dump; the 180-table drop | Moderate; needs platform and app owners in the same room |
| Restore rehearsals that include backup-table loss | Nothing — but it's the difference between an incident and an outage | A day per quarter |
Gambit published IOCs — staging and C2 IPs, skimmer hosting domains, and a distinctive insertion pattern using a seven-character junk prefix before a base64 blob. If you run e-commerce, that list is a one-hour hunt, and it's free. Start there, then come back to the architecture questions.
The honest caveats
This is a single-vendor interim report, and Gambit says so plainly: parts of the impact assessment rest on the agents' own logs and claims, which they cross-checked against exfiltrated data on the staging server and live skimmers found in the wild, but could not verify in every case. Fifty-seven of the 105 attack projects had been deleted before analysis. They expect the real scope to be larger — which cuts both ways for precision.
Second, "autonomous" is doing load-bearing work in the headlines. A human chose the targets, supplied working admin passwords on at least two of them, and typed nearly two thousand steering prompts. That is meaningfully more capable than last year's demos and meaningfully less than an unattended machine. The distinction matters when you're sizing your response.
Third, Gambit sells resilience validation, and the report's closing argument — that the answer is knowing which systems constitute your minimum viable business — is also their product thesis. It happens to be good advice. It's still worth naming.
The durable read: agent harnesses are now general-purpose operational infrastructure, and the same properties that make them useful internally — persistence, self-modification, tool breadth, tireless retry — are exactly what made them effective here. If you're deploying them, the controls in that table aren't a security tax. They're what makes the deployment survivable. If you want a second pair of eyes on how your agents are scoped, start here.
Frequently Asked Questions
Did AI actually find new vulnerabilities in this campaign?
No. The documented chains used well-known classes of flaw: unauthenticated SQL injection, an unrestricted file upload, a permissive sudo rule, an NFS export with no_root_squash, and database credentials left in a config file. The agents didn't invent exploits — they industrialised the discovery and chaining of ordinary ones, at a tempo and price point that made low-value targets worth attacking.
Should we stop using open-source agent frameworks internally?
No, but change how you deploy them. The properties abused here are the same ones you want: persistence, self-written skills, scheduled jobs, broad tool access. Treat persisted skills and memories as source code under version control with review. Enforce egress allow-lists at the network layer. Scope credentials per task with short lifetimes. Require human approval for destructive database operations.
How was data destroyed if this wasn't ransomware?
The attacker's playbook included a wipe-after-extraction step to erase card fields once the data had been exfiltrated, which caused operational disruption at several retailers. At one bicycle retailer, the agent's cleanup matched table names too broadly and dropped 180 tables, including backup tables the victim's own administrators had created. The damage was a side effect of the attacker covering tracks, not a demand.
Does model-provider safety filtering prevent this kind of abuse?
Only partially. Gambit reports the orchestration harness fell back to an older Anthropic model after newer ones refused, while scanning and exploitation ran on GLM and DeepSeek models through a single aggregator. Refusal behaviour raises cost and friction; it doesn't close the path when a router exposes many models behind one key. For defenders, that means network egress control matters more than model selection policy.
What is the fastest check an e-commerce team can run today?
Diff every JavaScript file your checkout serves against your build artefacts, ignoring timestamps — the most common injection method appended a loader to a legitimate library file and restored the original timestamp. Then inspect your Google tag block for padded whitespace hiding a loader off-screen, and check outbound requests from checkout pages against the skimmer domains in Gambit's published IOC table.
Research digest
AI Research Briefing
Honest insights on AI agents, Small Language Models, and local RAG. No hype. Only when we have something worth sending.
- No hype, just measurable outcomes
- Read by 2,400+ engineers
- Unsubscribe anytime