<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb" -->

---
title: AI agents stole 600,000 credit cards for about $25 a...
description: Security firm Gambit says a single attacker used three open-source AI agent frameworks—Strix, Cairn, and Hermes—running on Claude Opus 4.6, DeepSeek V4/V4.1,...
canonical: https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: AI agents stole 600,000 credit cards for about $25 a target, Gambit says | daily.dev
og:description: Security firm Gambit says a single attacker used three open-source AI agent frameworks—Strix, Cairn, and Hermes—running on Claude Opus 4.6, DeepSeek V4/V4.1,...
og:url: https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb
og:image: https://api.daily.dev/og/posts/q32xMneXB.png
og:image:alt: AI agents stole 600,000 credit cards for about $25 a target, Gambit says
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AI agents stole 600,000 credit cards for about $25 a target, Gambit says

**[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments

## Summary

Security firm Gambit says a single attacker used three open-source AI agent frameworks—Strix, Cairn, and Hermes—running on Claude Opus 4.6, DeepSeek V4/V4.1, and GLM 5.2 to breach at least 27 companies and steal over 600,000 credit card records. Average scans cost about $25, with the full campaign estimated at $12,000–$18,000. The operator typed under 2,000 prompts in Chinese across 260 sessions, gaining access in hours in many cases. Skimmers were hidden in jQuery libraries, Google tags, and Kubernetes containers; one retailer's cron job reinstalled the skimmer every two minutes. Cleanup routines also destroyed data, dropping 180 database tables including backups at one victim.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://thenextweb.com/news/ai-agents-600000-credit-card-records-gambit>

## Questions this post answers

### How much did it cost attackers to run AI agent scans that stole 600,000 credit card records?

A completed scan cost about $25.46 on average, ranging from $3.13 to $79.31. The operator's OpenRouter account spent $7,005.71 over four weeks, and Gambit estimates the full campaign cost between $12,000 and $18,000 to compromise at least 27 companies and steal over 600,000 credit card records.

_Security teams tracking AI-driven attack economics can follow incidents like this on daily.dev._

### Which AI models and agent frameworks were used in the Gambit-reported credit card theft campaign?

Three open-source agent frameworks were involved: Strix (a penetration testing tool) ran on Z.ai's GLM 5.2 and later DeepSeek V4 Pro; Cairn (an autonomous penetration testing agent) ran on DeepSeek V4.1 Flash; and Hermes, which ran the overall campaign and hacked targets directly, used Anthropic's Claude Opus 4.6 with 121 skills, 78 for attacks.

_Anyone weighing which AI agent stack to trust or defend against can follow this coverage on daily.dev._

### How did attackers hide credit card skimmers on compromised e-commerce sites?

Skimmers were hidden inside JavaScript libraries such as jQuery, inside Google tags, and inside Kubernetes containers. At one US wine retailer, a cron job reinserted the skimmer every two minutes after the site was redeployed, making the compromise persistent even through cleanup attempts.

_Developers hardening e-commerce sites against skimmer persistence can track findings like this on daily.dev._

## Similar posts on daily.dev

- [I Asked 100 Agents to Hack Me](https://daily.dev/posts/i-asked-100-agents-to-hack-me-wrbcfxglt) · Tech Lead Digest · 1 upvotes · 0 comments
- [A Glimpse into the “Search Your Target” Market for Stolen Credentials](https://daily.dev/posts/a-glimpse-into-the-search-your-target-market-for-stolen-credentials-aai3oymfd) · BleepingComputer · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude)

[View this post on daily.dev](https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"AI agents stole 600,000 credit cards for about $25 a target, Gambit says","url":"https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb"},"datePublished":"2026-09-28T10:02:53.497Z","dateModified":"2026-09-28T10:03:52.892Z","description":"Security firm Gambit says a single attacker used three open-source AI agent frameworks—Strix, Cairn, and Hermes—running on Claude Opus 4.6, DeepSeek V4/V4.1,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ef8a639962929d2d22effeb43c7b05f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ef8a639962929d2d22effeb43c7b05f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ai-agents,claude","timeRequired":"PT3M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"AI agents stole 600,000 credit cards for about $25 a target, Gambit says"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-agents-stole-600-000-credit-cards-for-about-25-a-target-gambit-says-q32xmnexb#faq","mainEntity":[{"@type":"Question","name":"How much did it cost attackers to run AI agent scans that stole 600,000 credit card records?","acceptedAnswer":{"@type":"Answer","text":"A completed scan cost about $25.46 on average, ranging from $3.13 to $79.31. The operator's OpenRouter account spent $7,005.71 over four weeks, and Gambit estimates the full campaign cost between $12,000 and $18,000 to compromise at least 27 companies and steal over 600,000 credit card records. Security teams tracking AI-driven attack economics can follow incidents like this on daily.dev."}},{"@type":"Question","name":"Which AI models and agent frameworks were used in the Gambit-reported credit card theft campaign?","acceptedAnswer":{"@type":"Answer","text":"Three open-source agent frameworks were involved: Strix (a penetration testing tool) ran on Z.ai's GLM 5.2 and later DeepSeek V4 Pro; Cairn (an autonomous penetration testing agent) ran on DeepSeek V4.1 Flash; and Hermes, which ran the overall campaign and hacked targets directly, used Anthropic's Claude Opus 4.6 with 121 skills, 78 for attacks. Anyone weighing which AI agent stack to trust or defend against can follow this coverage on daily.dev."}},{"@type":"Question","name":"How did attackers hide credit card skimmers on compromised e-commerce sites?","acceptedAnswer":{"@type":"Answer","text":"Skimmers were hidden inside JavaScript libraries such as jQuery, inside Google tags, and inside Kubernetes containers. At one US wine retailer, a cron job reinserted the skimmer every two minutes after the site was redeployed, making the compromise persistent even through cleanup attempts. Developers hardening e-commerce sites against skimmer persistence can track findings like this on daily.dev."}}]}
```