AI agents stole 600,000 credit cards in retail breach

An attacker deployed autonomous agents built on multiple AI models to identify vulnerabilities, compromise at least 27 companies, and exfiltrate more than 600,000 valid credit-card records during a five-day campaign in mid-September 2026, according to Gambit Security.

Three agent frameworks, multiple models

The attacker used three open-source AI-agent frameworks to execute the operation, Gambit reported. Strix initially ran on Z.ai's GLM 5.2 model before switching to DeepSeek V4 Pro; Cairn used DeepSeek V4.1 Flash; and Hermes ran on Anthropic's Claude Opus 4.6. The campaign involved 105 offensive operations between September 10–15, with Hermes featuring 121 total skills—78 of them attack-specific.

Scale and geographic focus

Of the stolen records, 488,372—approximately 79%—were associated with U.S.-issued cards, suggesting a targeted strategy focused on North American financial infrastructure. Gambit's analysis identified at least 27 confirmed compromises during the five-day window, though broader reporting cited attacks against as many as 100 organizations and skimmer deployment on additional retail sites.

The attacker's exposed server contained information on at least 618,000 card records, though it was not established that every record had been successfully monetized or used in downstream fraud.

Operational tactics

The autonomous agents conducted reconnaissance, vulnerability scanning, and exploitation with minimal human intervention. Gambit identified 146 Strix scanning runs during the operational period, indicating systematic probing of network defenses. The agents then deployed payment-card skimmers on retail checkout systems to harvest transaction data.

Investigation status

No verified court filing, arrest, criminal sentencing, or regulatory enforcement action related to the campaign has been publicly confirmed as of October 8, 2026. Law enforcement and financial regulators have not released official statements on the matter. The victim companies and attacker identity remain undisclosed in verified public reporting.

The incident underscores emerging vulnerabilities in how open-source agentic frameworks can be repurposed for large-scale financial crime when paired with commercial or open-weight AI models. It represents a material escalation in the sophistication and scale of agent-driven attacks on payment infrastructure.