started · updated
AI agents used in massive hacking campaign to steal 600,000 credit cards
A China-based hacker utilized a trio of autonomous AI agents to execute a large-scale cyberattack campaign between July and September 2026. According to research by Gambit Security, the attacker used open-source AI tools to automate the hacking process, significantly reducing human intervention and operational costs.
The toolkit included Strix for identifying security vulnerabilities, Cairn for autonomous exploitation to gain administrator access, and Hermes—powered by Anthropic’s Claude Opus 4.2—to orchestrate the overall strategy. The campaign compromised 119 e-commerce sites and 27 companies, including a Fortune 500 hotel chain and a major American airline. The breach resulted in the theft of 600,000 credit card details.
Analysis shows the operation was highly cost-effective, with the attacker spending roughly $25 per target.
Separately, cybersecurity expert Hakan Topuzoğlu has warned of emerging risks in 'agentic commerce,' where AI agents perform automated shopping and payments on behalf of users. Topuzoğlu noted that these machine-to-machine (M2M) systems are vulnerable to hijacking, which could allow criminals to place fraudulent orders using a victim's credentials.
Entities
Anthropic · Claude Opus 4.2 · DeepSeek · Gambit Security · HP · Hakan Topuzoğlu · MetaMask
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] The campaign compromised 119 e-commerce sites and 27 companies between July and September 2026. www.computerworld.com
- [○ 1 SOURCE] The attacker stole 600,000 credit card details. www.computerworld.com
- [○ 1 SOURCE] A China-based individual used three autonomous AI agents to conduct a massive hacking campaign. www.computerworld.com
- [○ 1 SOURCE] The Cairn agent was used for autonomous end-to-end exploitation. www.computerworld.com
- [○ 1 SOURCE] The cost of the attack averaged approximately $25 per target. www.computerworld.com
- [○ 1 SOURCE] The attacker used the Strix agent to find security vulnerabilities. www.computerworld.com
- [● 3 SOURCES] AI shopping agents used in e-commerce platforms can be hacked to create fraudulent orders. yerkoyhabergazetesi.com · www.haberport.com · www.sondakika.com