Open-source AI agents breach online retailers and plant card skimmers

Confirmed

Gambit recovered the operator's staging server and reconstructed the campaign, per press coverage.

Three open-source agent harnesses discovered vulnerabilities, exploited them and coordinated jobs against hundreds of retailers at roughly $25 per target, with human prompts steering Hermes.

“The operation relied on three open-source AI harnesses working together with minimal manual input, including Strix, Cairn, and Hermes.”Hackread (reporting Gambit Security)

Sources

Open-Source AI Agents Breach 27 Companies, Steal 600,000 Credit Card RecordsHackread (reporting Gambit Security) · 22 Sep 2026 · secondary source

Date: Jul 2026
Disclosed: 22 Sep 2026
Actor: Unnamed financially motivated operator (criminal), as attributed by Hackread (reporting Gambit Security)
Targets: Online retailers (at least 27 compromised; a US airline and hospitality firm among those named in coverage)
What the AI did: Vuln research, Exploit dev, Agentic intrusion, Ops automation, Fraud
Model: Strix, Cairn, Hermes harnesses; per secondary coverage of the Gambit report the models included Claude Opus 4.6, DeepSeek V4 family and Z.ai GLM via OpenRouter (not re-verified on the fetched page)
Model family: Open-source harness, Unspecified, Anthropic
Model basis: stated by researcher
Autonomy: semi-autonomous
Outcome: Over 600,000 payment card records reportedly stolen; skimmers installed on 100+ sites.