Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards
Brief
A financially motivated operator has been running three open-source AI tools against many online retailers, mostly without supervision.
The results are shocking: over 600,000 credit card records have been stolen, scripts to gather card information have been placed on dozens of checkout pages, and in at least two cases, the operator’s cleanup routine completely wiped out the victims’ data.
Gambit Security’s Threat Intelligence team recovered the operator’s exposed staging server and reconstructed the campaign from what it left behind, and the picture it reveals is sobering for every security team.
The economics are what make this campaign so alarming. Between August and September 2026, the operator spent somewhere between $12,000 and $18,000 on AI model access through OpenRouter, a figure corroborated by an account balance snapshot of $7,005.