A Chinese-speaking attacker used AI agents to target 105 e-commerce sites during a five-day campaign in September, compromising at least 27 companies, according to Gambit Security. The security firm reported an average cost of $25.46 per completed target.
The findings, reported by Dark Reading on October 23, describe payment-card theft, website skimming and unauthorized access across businesses that included at least one Fortune 500 company.
Gambit said the agents stole at least 600,000 payment card records from two companies and installed credit-card skimmers on five companies’ websites. Other compromises involved varying degrees of illicit access. The record count does not establish how many individual cardholders were affected.
The attacker used the agentic AI system Hermes and the penetration-testing frameworks Strix and Cairn, combining open-weight and public AI models, according to Gambit. The findings describe a campaign in which agents performed hacking and data-theft operations; they do not establish that AI introduced a new class of vulnerability.
Sa’ar Elias, Gambit’s co-founder and chief research officer, said the campaign illustrated how one person could now perform work that previously required a coordinated group of skilled attackers. That assessment comes from the firm that discovered the activity.
A separate lab test illustrates the speed of compromise
Researchers at Silverfort reported a separate laboratory exercise using an orchestrating agent and publicly available versions of Claude Opus. Starting with initial access, the agent gained complete domain control in eight minutes at a cost of about $12, according to Colin Ferris, the company’s threat hunting and incident response lead.
The exercise measured what an agent could do after obtaining a foothold. It was a controlled test, distinct from Gambit’s findings about attacks on retailers.
Ferris said the outcome changed when researchers strengthened controls, particularly authentication and access. Under those conditions, the same agent encountered 21 dead ends and stopped.
“AI didn’t create these weaknesses; it just finds them faster,” Ferris told Dark Reading. He identified overprivileged accounts, reused credentials and unmanaged service accounts as paths defenders should address, alongside automating access decisions.
Lower attack costs put pressure on defensive spending
The campaign’s reported costs add to evidence that attackers can scale operations cheaply. Flashpoint separately reported that the average price of sold initial access fell from just over $1,400 to $429 as supply increased in underground markets.
Ian Gray, Flashpoint’s vice president of intelligence, distinguished that measured price decline from the company’s broader observations about AI: initial access is where Flashpoint measured falling prices, while elsewhere it sees AI making attacks faster and easier to scale.
For defenders, Elias argued that applying AI to existing security processes would be insufficient on its own. He said companies should identify the business processes most critical to continued operations and prioritize investments that protect them from disruption.
Albert Ziegler, chief information security officer at offensive security firm XBOW, similarly warned that protecting only a few high-priority websites leaves other exposed systems vulnerable. In his assessment, inexpensive attacks succeed because sites have not been sufficiently hardened.
The practical concern is the imbalance between cheap, repeatable attack attempts and the cost of maintaining reliable defenses across a business. The retailer campaign documents that pressure through reported compromises; Silverfort’s laboratory results suggest that stronger access controls can still interrupt an agent’s progress.
