Tools
AI agents stole 600K credit cards — at about $25 per company
Gambit Security reports an ongoing campaign in which an operator used three open-source AI agents — Strix, Cairn, and Hermes — against online retailers, taking more than 600,000 credit-card records and planting skimmers on 100-plus sites at a marginal cost of about $25 per target. Per Gambit’s blog and BleepingComputer’s write-up, activity dates back to July 2026, with the agents running largely unattended after short human prompts. High-level only: no PoC, no YARA, no exploit rebuild steps. This is Gambit’s retailer-agent / card-theft report, not Microsoft’s EvilTokens disruption, not the OpenAI Medicare agent case, and not Cisco Talos’s same-named Cairn malware tool.