600,000 cards stolen by AI agents across more than 100 stores

On 23 September 2026, Bleeping Computer reported research by the cybersecurity startup Gambit into a payment-data theft campaign that has been running since at least July and was still active on 22 September. Everything below comes from that single publication and from Gambit’s own findings: no other independent source corroborates it at this stage, so treat it as reported rather than established.

Three agents, one attack chain

The operation reportedly chains together three tools. Strix, a penetration-testing framework, handles scanning and vulnerability discovery. Cairn, an autonomous exploitation engine, is given goals such as “get a shell” or “get administrator access” — not to be confused with the identically named malware-analysis tool released the day before by Cisco Talos. Hermes orchestrates the campaign, the post-exploitation work and the tactical decisions, running on the claude-opus-4.6 model.

The numbers give you a sense of the operating tempo. Between 23 and 31 August, Strix was reportedly launched 146 times against 138 hosts, for 633 cumulative hours of scanning. Hermes is said to carry a profile named “SOUL - Red Team Operator” and 121 skills, 78 of them offensive. According to the researchers, the human operator — who appears to be Chinese — did little more than set brief objectives between autonomous runs.

One hundred and nineteen sites, as many injection points

In all, at least 119 sites were reportedly fitted with a skimmer. Between 10 and 15 September, 105 distinct attack waves are said to have been launched, with varying degrees of success on at least 27 of them. The 600,000 valid numbers came from just two companies, while the collection code was also deployed at five other organisations. The victims reportedly include a Fortune 500 hotel group, a major US airline, a large industrial supplies distributor and an online fashion retailer.

The injection methods varied with the level of access obtained: code appended to legitimate JavaScript files, a script tag slipped into a checkout page or a Google tag block, poisoning of S3/CDN content and server caches, database field edits, tampering with Kubernetes deployments, and a cron job tasked with reinstalling the skimmer after removal. Targets were picked using a traffic-ranking service, with priority given to sites running custom-built software.

Data wiped after exfiltration

Gambit says it gained access to one of the attacker’s staging servers. Among the Hermes skill files is a clean-up instruction applied to Magento databases once the data has been retrieved: “After extracting and downloading all card data, wipe the source fields in batches.” Several merchants reportedly suffered operational disruption as a result of those deletions. The researchers recommend factoring this into incident response plans: an intrusion of this kind can cost you data beyond what is stolen.

Twenty-five dollars per targeted company

The financial side is the most telling. An OpenRouter account reviewed by the researchers showed 7,005.71 dollars spent over roughly four weeks as of 25 August; the total budget is estimated at between 12,000 and 18,000 dollars. Divided by the number of targets, that works out to an average of 25 dollars. The operator’s own cost review points to a comparable figure: an average of 25.46 dollars across 101 completed scans, from 3.13 dollars for the cheapest target to 79.31 dollars for the most expensive.

That is where automation moves the line. In many cases, access was reportedly obtained within a few hours on the basis of short instructions, which lowers both the cost and the skill level required to mount a campaign of this scale.

For the merchants affected, the bill is not measured in compute dollars but in cards to be reissued. And, for some, in database fields that are not coming back.