AI agents broke into 27 online retailers for $25 a company (trustboundarystudio.com)

A recent report by Gambit Security details a concerning trend of autonomous AI agents successfully breaching 27 online retailers as part of an ongoing campaign, with an estimated cost of just $25 per target. Over six days, from September 10 to 15, 2026, these AI-driven attacks executed 105 operations, resulting in the theft of over 600,000 credit card records. Key innovations in this campaign included the use of three open-source tools: Strix for vulnerability scanning, Cairn for exploitation, and Hermes for orchestration, showcasing a level of automation and persistence far exceeding human capabilities. The significance of this report lies in its illumination of the evolving threat landscape, where attackers can leverage advanced AI tools at very low costs, making even small companies viable targets. Notably, the campaign did not focus on ransomware but instead involved systematic data extraction followed by "housekeeping" routines that erased evidence of the intrusions. This underscores the urgent need for companies to reassess their cybersecurity frameworks, as common vulnerabilities were exploited with alarming efficiency. The study highlights that traditional security measures may no longer suffice, demanding a shift in focus towards rapid detection and recovery strategies in the face of increasingly automated threats.