A single attacker broke into at least 27 companies this summer by letting AI agents do most of the work. Gambit Security, which investigates attacks, pieced the campaign together after it recovered the operator's staging server.
According to the report, the operation collected more than 600,000 payment card records. The victims range from a large hotel group and a major airline to hundreds of small online shops.
Why it matters
Most talk about AI in cybercrime has been about better phishing emails. This case shows freely available AI agents running long stretches of an attack on their own, with a human mostly setting goals. The researchers counted 260 sessions of the coordinating agent that ran with little human involvement.
The price is the other alarming part. Gambit puts the whole campaign at $12,000 to $18,000, roughly $25 in AI fees per target.
What the researchers found
The operator combined three open-source agent tools: one to coordinate, one to look for weaknesses and one to act on them. They ran on several commercial and open AI models bought through a single online service. Between September 10 and 15 alone, the operator started 105 separate attack projects.
The weaknesses were familiar ones: badly configured servers, old web flaws and cloud passwords left where they should not be. What was new was the pace. "At very low cost, the AI tools demonstrated a level of patience, persistence, and creativity that most human attackers would be unlikely to sustain," wrote Eyal Sela, Gambit's director of threat intelligence.
What defenders should do
Gambit's advice is to plan for recovery, not only prevention. Companies should know which systems keep revenue flowing and prove they can bring them back quickly after a break-in.
