--- title: AI agent toolkit lets one attacker compromise 119 retail... description: A financially motivated attacker used three open-source AI agent frameworks — Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes... canonical: https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI agent toolkit lets one attacker compromise 119 retail sites for $25 each | daily.dev og:description: A financially motivated attacker used three open-source AI agent frameworks — Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes... og:url: https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey og:image: https://api.daily.dev/og/posts/l6hSFFFeY.png og:image:alt: AI agent toolkit lets one attacker compromise 119 retail sites for $25 each og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI agent toolkit lets one attacker compromise 119 retail sites for $25 each **[Collections](https://daily.dev/sources/collections)** · 2 min read · 3 upvotes · 0 comments ## Summary A financially motivated attacker used three open-source AI agent frameworks — Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes (powered by Claude Opus 4.6) for orchestration — to compromise 119 retail websites since July, spending an average of $25 per compromised target ($7,005 total via OpenRouter). Two victims had over 600,000 active credit card numbers stolen, and five had skimmer scripts injected via JavaScript poisoning, S3/CDN poisoning, and Kubernetes deployment changes. Victims included a Fortune 500 hospitality company and a major U.S. airline. The attacker also ran cleanup routines to wipe extracted card data from Magento databases, sometimes disrupting victim operations. The case illustrates how AI agent tooling compresses the cost and expertise once required for sophisticated multi-stage e-commerce attacks. ## Content A single attacker has compromised at least 27 online retailers and stolen over 600,000 credit card records using a combination of three open-source AI agent frameworks, according to Israeli cybersecurity startup Gambit. The campaign has been active since at least July and has touched as many as 119 websites in total, including a Fortune 500 hospitality company and a major U.S. airline. ## How the attack worked The attacker chained together three open-source tools: Strix for vulnerability scanning, Cairn for autonomous exploitation, and Hermes for orchestration. Hermes ran on Claude Opus 4.6, while other components used DeepSeek V4/V4.1 and GLM 5.2. The operator typed fewer than 2,000 prompts in Chinese across 260 sessions — in many cases, the tools gained access within hours of being pointed at a target. Skimmers were hidden in jQuery libraries, Google tag scripts, S3 buckets, CDN configurations, and Kubernetes deployment files. One retailer's cron job was configured to reinstall the skimmer every two minutes, making cleanup nearly impossible without taking the system offline. At another victim, cleanup routines wiped 180 database tables, including backups, causing operational disruptions beyond the theft itself. ## The cost breakdown The attacker spent roughly $7,005 through OpenRouter over four weeks. Per-target costs ranged from $3.13 to $79.31, averaging around $25. Gambit estimates the full campaign cost between $12,000 and $18,000 when accounting for infrastructure. For that, the attacker walked away with 600,000 active credit card numbers from at least two businesses, skimmer scripts installed at five more, and partial access to several larger organizations. That math is what makes this campaign notable. Sophisticated, multi-stage intrusions used to require significant time and expertise. Here, the attacker largely supervised automated agents doing the work — five days of active attacks across 105 targeted retailers, 27 confirmed compromises. ## What it means None of the individual techniques are new. SQL injection, JavaScript skimming, and Kubernetes misconfigurations have been in attackers' playbooks for years. What's changed is the cost and effort required to chain them together at scale. The AI frameworks handled reconnaissance, exploitation, and persistence with minimal human input. Gambit hasn't named the affected companies. The campaign appears financially motivated rather than state-sponsored, which makes the economics even more striking — this wasn't a well-resourced nation-state operation. It was one person with a few hundred dollars a week and access to the same open-source tools anyone can download. ## Questions this post answers ### How much did it cost an attacker to compromise each retail website using AI agent tools? Roughly $25 per compromised target on average, with individual costs ranging from $3.13 to $79.31 depending on target difficulty. A financially motivated attacker spent $7,005 total through OpenRouter to compromise a significant portion of 119 retail sites over about four weeks using three open-source AI agent frameworks for discovery, exploitation, and orchestration. _Track how AI-driven attack economics are reshaping e-commerce security risk on daily.dev._ ### What open-source AI agent tools were used to automate the retail website attack campaign? Three open-source frameworks worked together: Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes for orchestrating the whole operation, powered by Claude Opus 4.6. None of the tooling was custom-built by the attacker, who simply chained existing open-source components into a working attack pipeline. _Security teams evaluating AI agent risks can follow tooling breakdowns like this on daily.dev._ ### What methods were used to inject credit card skimmers into compromised e-commerce sites? Skimmers were installed through JavaScript poisoning, malicious script tag injection, S3 and CDN poisoning, and unauthorized changes to Kubernetes deployments. Two businesses had over 600,000 active credit card numbers extracted, and five more had skimmer scripts installed via these methods, with victims including a Fortune 500 hospitality company and a major U.S. airline. _Engineers hardening e-commerce infrastructure against skimmer injection can follow incident details on daily.dev._ ## Similar posts on daily.dev - [I Asked 100 Agents to Hack Me](https://daily.dev/posts/i-asked-100-agents-to-hack-me-wrbcfxglt) · Tech Lead Digest · 1 upvotes · 0 comments - [Ship Fast, Leak Faster: Securing AI Agents before they cost you millions](https://daily.dev/posts/ship-fast-leak-faster-securing-ai-agents-before-they-cost-you-millions-t5kqfz2gr) · Softbinator · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#ecommerce](https://daily.dev/tags/ecommerce), [#magento](https://daily.dev/tags/magento) [View this post on daily.dev](https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI agent toolkit lets one attacker compromise 119 retail sites for $25 each","url":"https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey"},"datePublished":"2026-09-25T17:44:42.473Z","dateModified":"2026-09-28T10:03:51.438Z","description":"A financially motivated attacker used three open-source AI agent frameworks — Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c36f234fc9074028b5595f40c65e9b36?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c36f234fc9074028b5595f40c65e9b36?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ai-agents,ecommerce,magento","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"AI agent toolkit lets one attacker compromise 119 retail sites for $25 each"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-agent-toolkit-lets-one-attacker-compromise-119-retail-sites-for-25-each-l6hsfffey#faq","mainEntity":[{"@type":"Question","name":"How much did it cost an attacker to compromise each retail website using AI agent tools?","acceptedAnswer":{"@type":"Answer","text":"Roughly $25 per compromised target on average, with individual costs ranging from $3.13 to $79.31 depending on target difficulty. A financially motivated attacker spent $7,005 total through OpenRouter to compromise a significant portion of 119 retail sites over about four weeks using three open-source AI agent frameworks for discovery, exploitation, and orchestration. Track how AI-driven attack economics are reshaping e-commerce security risk on daily.dev."}},{"@type":"Question","name":"What open-source AI agent tools were used to automate the retail website attack campaign?","acceptedAnswer":{"@type":"Answer","text":"Three open-source frameworks worked together: Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes for orchestrating the whole operation, powered by Claude Opus 4.6. None of the tooling was custom-built by the attacker, who simply chained existing open-source components into a working attack pipeline. Security teams evaluating AI agent risks can follow tooling breakdowns like this on daily.dev."}},{"@type":"Question","name":"What methods were used to inject credit card skimmers into compromised e-commerce sites?","acceptedAnswer":{"@type":"Answer","text":"Skimmers were installed through JavaScript poisoning, malicious script tag injection, S3 and CDN poisoning, and unauthorized changes to Kubernetes deployments. Two businesses had over 600,000 active credit card numbers extracted, and five more had skimmer scripts installed via these methods, with victims including a Fortune 500 hospitality company and a major U.S. airline. Engineers hardening e-commerce infrastructure against skimmer injection can follow incident details on daily.dev."}}]} ```