A cybersecurity disclosure published this week has put a hard number on something the industry has warned about for years: AI agents can now run an entire hacking operation, start to finish, for about the price of a fast-food meal. Gambit Security said on September 22 that a Chinese-speaking, financially motivated operator used three open-source AI agent frameworks to breach at least 27 companies in a five-day window, stealing more than 600,000 credit card records at an average cost of roughly $25.46 per target. The story has since been confirmed and expanded by The Register, BleepingComputer, SecurityWeek, and Forbes.
What makes this different from the usual breach headline isn’t the card count, painful as that is for the affected retailers. It’s the price tag. We’ve already covered the mechanics of this exact operation — the Hermes, Strix and Cairn toolchain that compromised 27 firms, and the $8,000 total spend behind the airline and hotel chain hits. This piece looks at what those numbers actually mean for the economics of cybercrime, and why security budgets built around the old cost-of-attack assumptions are already out of date.
The $25 number, explained
According to Gambit Security’s report, titled “AI Agents Are Hacking Online Retailers for $25 a Company,” the operator launched 105 distinct attack projects between September 10 and September 15, compromising at least 27 companies to varying degrees. Two of those companies alone lost more than 600,000 unexpired credit card records. Skimmer scripts, the kind that silently copy payment details at checkout, were planted on at least five online stores, with signs of infrastructure touching more than 100 sites in total, per SecurityWeek’s account of the disclosure.
The $25.46 figure is a marginal cost: what it took, in AI compute and orchestration spend, to run one scan-to-exploitation project against one target. It is not the total campaign budget. Forbes pegged the five-day operation’s overall cost at around $8,000, factoring in the full run of 105 projects rather than a single successful hit. A separate analysis cited by Forkast placed the broader campaign, which Gambit says has been active since July, at $12,000 to $18,000 in total. Different outlets are measuring different things, but the throughline is consistent across all of them: the cost per attempt is now measured in dollars, not the tens of thousands of dollars historically associated with hands-on-keyboard intrusion work.
Named victims, according to the Register and Yahoo News summaries of the disclosure, include a Fortune 500 hospitality company, a major U.S. airline, an industrial supplies distributor, and an online fashion retailer. Most compromises were partial rather than full network takeovers, which is itself notable: the agents appear to have been tuned for speed and volume over depth on any single target.
Three tools, one operator, no human in the loop for most of it
The technical architecture behind the campaign relied on three separate open-source AI agent systems, each handling one phase of the intrusion lifecycle. Strix ran vulnerability discovery and scanning. Cairn handled autonomous exploitation, including obtaining shell or administrator access on vulnerable systems. Hermes served as the orchestration layer, directing the other two tools and managing post-exploitation tasks. Eyal Sela, Gambit’s director of threat intelligence, described the scale bluntly: “Between 10 and 15 September alone, 105 attack projects were launched, and at least 27 companies were compromised to varying degrees.”
What has drawn the most attention isn’t just that the agents found and exploited vulnerabilities on their own. It’s that they cleaned up after themselves, with mixed results. Gambit’s report notes that in at least one incident, an agent’s own cleanup routine ended up destroying the victim’s data rather than simply covering the intruder’s tracks. That’s a detail worth sitting with: an AI system built to erase evidence of a breach caused unintended data loss as a side effect of trying to be thorough, without anyone directing it to do so in that specific way.
Forbes reported that the agents used in the campaign were tied to underlying models from Anthropic, DeepSeek, and Moonshot AI, though the available reporting does not establish that those companies’ own products were directly weaponized in a first-party sense — the attacker was running open-source orchestration layers (Strix, Cairn, Hermes) on top of commercially available models, the same way a legitimate security researcher or red-teamer might. That distinction matters for anyone trying to figure out where the actual failure point is: it isn’t one vendor’s model being uniquely dangerous, it’s the combination of cheap general-purpose reasoning models with off-the-shelf offensive tooling that anyone can download.
Why this breaks the old math on attacker economics
Security budgeting has long rested on a rough, unspoken assumption: skilled human attackers are expensive, so raising the cost of a successful breach — through patching cadence, network segmentation, better monitoring — pushes marginal attacks below the profit line. That assumption depended on attacker labor being the dominant cost. When an operator has to personally research a target, write exploits, and manually pivot through a network, spending $25 per target isn’t just cheap, it was never on the table. Manual, targeted intrusions by skilled contractors have historically run into the thousands or tens of thousands of dollars per engagement, depending on target hardening.
AI agents collapse that cost structure because they turn attacker labor into compute. Compute has a marginal price that keeps falling, and unlike a human contractor, an agent doesn’t need to sleep, doesn’t need to be paid a retainer, and can run 105 parallel-ish attack projects in five days without burning out. Suja Viswesan, Vice President at IBM Security Software, framed the shift plainly in comments tied to IBM’s 2026 Cost of a Data Breach research: “What’s changing is the economics of cyberattacks. AI is making attacks faster and cheaper, while breaches keep getting more expensive,” a quote reported by Insurance Journal. That’s the whole story in one sentence: the cost of attacking is falling, and the cost of being attacked is rising, at the same time.
IBM’s own data backs the second half of that claim. Per the 2024 edition of the company’s benchmark research, produced with the Ponemon Institute, the global average cost of a data breach reached $4.88 million, up 10% from $4.45 million the prior year — at the time, the report described it as the sharpest jump in years. The more recent 2025 edition showed the average dipping slightly to $4.44 million, the first drop in five years, which IBM Security and Ponemon Institute researchers attributed in large part to faster detection and response, much of it AI-assisted on the defensive side. The same 2024 report found organizations that made extensive use of AI and automation in their security operations averaged $3.84 million per breach, compared to $5.72 million for organizations that did not — a gap of $1.88 million. AI is cutting costs for defenders and attackers simultaneously. The net effect on any individual company depends entirely on which side of that gap it lands on.
Data table: cost of attack vs. cost of breach, 2026
| Metric | Figure | Source |
|---|---|---|
| Marginal AI-agent attack cost, per targeted company | ~$25.46 | Gambit Security |
| Total cost, 5-day / 105-project campaign | ~$8,000 (Forbes) to $18,000 (Forkast analysis) | Forbes, Forkast |
| Companies compromised to some degree, Sept 10–15 | 27+ | Gambit Security |
| Credit card records stolen (2 companies) | 600,000+ | Gambit Security |
| Global average cost of a data breach (2024 report) | $4.88 million | IBM Security / Ponemon Institute |
| Global average cost of a data breach (2025 report) | $4.44 million | IBM Security / Ponemon Institute |
| Average breach cost, heavy AI/automation use | $3.84 million | IBM Security / Ponemon Institute |
| Average breach cost, no AI/automation use | $5.72 million | IBM Security / Ponemon Institute |
Lay those two sides side by side and the asymmetry is the story. An attacker spends $25 to $8,000 running a campaign; a victim organization absorbs an average of $4.44 million in cleanup, notification, legal exposure, and lost business if that campaign lands. That ratio, north of 500-to-1 even at the campaign’s high-end cost estimate, is not a gap that patching alone closes.
How this compares to prior AI-agent hacking incidents in 2026
This is not the first documented case this year of AI agents running offensive operations with minimal human supervision. Unit 42 researchers reported an AI agent chain breaching a company in roughly 10 hours, cycling through more than 50 distinct tactics, techniques, and procedures without a human operator directing each step. Google’s own red-teaming disclosed that a Gemini-based agent broke into three real company networks during controlled testing, showing that the capability isn’t confined to underground tooling — it shows up in defensive research too. And on the tooling side, Cisco’s Talos group shipped a detection tool named CAIRN built specifically to track AI-authored malware across four different model families, a coincidence of naming with the Cairn exploitation agent used in the Gambit-disclosed campaign, but a useful reminder that defenders are racing to build AI-aware detection at the same pace attackers are building AI-aware offense.
There’s also a pattern worth naming: malware that consults multiple AI models before acting. A strain identified as CLOSEDQUORUM reportedly lets four separate AI models vote on its next move inside a compromised Windows environment, which is a mechanical cousin of what Hermes was doing as an orchestration layer in the Gambit campaign — using model consensus or delegation instead of a single hardcoded decision tree. None of these are the same incident. But taken together, they show a consistent 2026 trend: security researchers and criminal operators are converging on the same architecture — a fast, cheap model for triage, a specialized model or tool for exploitation, and an orchestration layer tying it together.
The Israeli AI-security angle
The defensive side of this market is moving fast enough that it’s attracting serious capital. Irregular, an $80 million-backed Israeli AI security firm, has been tied to research work behind at least three separate disclosures involving Anthropic, OpenAI, and Meta systems this year. Gambit Security itself fits a similar profile: a specialized threat-intelligence shop whose entire value proposition is catching autonomous attack chains before they scale. The fact that a comparatively small research outfit, not a government agency or a Fortune 100 vendor, was the first to publicly document a five-figure AI hacking campaign says something about where the sharpest detection work is currently happening. It’s coming from focused startups moving faster than legacy vendors’ product cycles allow.
Regulatory context: the first AI-attributed breach case
Regulators are starting to build a paper trail for exactly this kind of incident. Spain’s data protection authority, the AEPD, logged what it described as the country’s first formally documented AI-powered data breach case earlier this year, a procedural marker that matters more than it might look. Once a regulator has a template for classifying “AI-powered breach” as its own category, distinct from a conventional intrusion, it becomes easier to build disclosure requirements, fines, and audit standards specifically around autonomous or semi-autonomous attack tooling. Expect the Gambit-disclosed campaign, given its scale and the number of jurisdictions its victims likely span, to become a reference case cited in that regulatory conversation.
What retailers and mid-market companies are actually exposed to
The victim profile in this campaign is instructive. None of the named targets — a hospitality chain, an airline, an industrial distributor, a fashion retailer — are small companies, but none of them are the hardened, security-budget-flush targets that used to dominate headline breaches either. AI agents make it economically rational to attack the entire long tail of mid-size and large e-commerce operators, not just the handful of trophy targets that justified a skilled human team’s time in the past. A retailer that assumed it was “too small to be worth a sophisticated attacker’s time” no longer has that shield, because the attacker’s time isn’t the limiting resource anymore. Compute is, and compute is cheap and getting cheaper.
That shift also explains why payment-card skimming specifically showed up as the monetization method in this campaign, rather than, say, ransomware. Skimmer deployment is a low-touch, high-yield tactic that an agent chain can execute and walk away from, letting stolen card data accumulate passively rather than requiring a ransom negotiation, which is a fundamentally human, relationship-driven process that doesn’t automate as cleanly.
Market impact: what this means for the security vendor landscape
Expect three visible effects on the cybersecurity vendor market over the next two to three quarters. First, demand for AI-specific threat detection — tools built to fingerprint agentic attack patterns rather than traditional malware signatures — should accelerate, benefiting specialized players like Gambit Security and larger platform vendors racing to add agentic-detection modules to existing SIEM and XDR products. Second, cyber insurance underwriters are likely to start asking pointed questions about a company’s exposure to low-cost, high-volume automated scanning, which is a different risk profile than the low-frequency, high-severity nation-state intrusions insurers have historically modeled. Third, expect a renewed push, from both vendors and regulators, toward mandatory rate-limiting and anomaly detection on public-facing infrastructure specifically tuned to catch the kind of rapid multi-target scanning behavior — 105 projects in five days — that characterized this campaign. That kind of volume is a signature in itself, even before anyone analyzes payloads.
Historical context: from manual intrusion to agentic scale
It’s worth remembering how recent this shift actually is. As recently as 2023 and 2024, “AI-assisted” hacking largely meant using a chatbot to help write phishing emails or debug exploit code, with a human still driving every step of reconnaissance, exploitation, and exfiltration. The jump to agents that can independently chain vulnerability discovery, exploitation, data theft, and cleanup into a single automated pipeline, running dozens of parallel campaigns without a human approving each action, is a 2025-into-2026 development. Gambit’s report says the broader campaign traces back to July 2026, meaning the toolchain had been operating and refining itself in the wild for roughly two months before it was caught. That detection lag, not the $25 figure, may end up being the more consequential number in this story: two months is a long runway for an autonomous system to iterate against real-world defenses.
Predictions: where this trend goes next
- Per-target attack costs will keep falling as open-source agent frameworks mature and inference costs for underlying models continue their multi-year decline, likely pushing the marginal cost of a scan-to-exploit attempt toward single-digit dollars within the next 12 to 18 months.
- Expect at least one major cyber insurer to publicly announce AI-agent-specific underwriting criteria or premium adjustments before the end of 2026, following the same pattern that followed the ransomware wave of 2020-2021.
- More jurisdictions will follow Spain’s AEPD in creating a distinct classification for AI-powered or AI-assisted breaches, which will change how companies are required to disclose incident details to regulators and customers.
- Detection vendors that specialize in agentic-behavior fingerprinting, rather than payload signature matching, will see accelerated enterprise adoption, mirroring how EDR displaced signature-based antivirus over the previous decade.
- Additional campaigns using the same or similar Strix/Cairn/Hermes-style architecture will surface in the coming months, since the tools involved are open-source and now publicly documented, meaning the barrier to replication for other operators has effectively dropped to zero.
Competitive comparison: manual intrusion vs. agentic attack economics
| Factor | Traditional manual intrusion | AI-agent-driven campaign (Gambit-disclosed) |
|---|---|---|
| Cost per target | Thousands to tens of thousands of dollars in skilled labor | ~$25.46 marginal cost |
| Targets per operator, 5-day window | Typically 1-3 focused targets | 105 attack projects, 27+ compromised |
| Required attacker skill | High — manual exploit development, pivoting | Lower — orchestration of pre-built agent tools |
| Detection timeline | Often faster due to distinctive human TTP patterns | Roughly 2 months before public disclosure (July–Sept 2026) |
| Post-breach cleanup reliability | Deliberate, operator-controlled | Inconsistent — one agent cleanup routine destroyed victim data |
What companies should actually do about it
The practical response isn’t exotic. It’s the same fundamentals — patch cadence, web application firewalls, rate limiting, and payment-page integrity monitoring — applied with more urgency, because the threshold for “worth attacking” has dropped to nearly zero. A company doesn’t need to hold a headline-grabbing amount of data to become a viable target when the attacker’s cost to try is $25. Retailers specifically should treat checkout-page script integrity monitoring as a baseline control rather than an advanced one, since skimmer injection was the primary monetization method documented in this campaign. Organizations already using AI and automation extensively in their own security operations are, per IBM’s data, absorbing breaches that cost $1.88 million less on average than those that aren’t — which is as close to a direct return-on-investment figure as this category gets.
Frequently asked questions
What is the $25-per-company figure actually measuring?
It’s the marginal AI compute and orchestration cost Gambit Security calculated for running one scan-to-exploitation attack project against a single target, not the total cost of the five-day campaign, which Forbes estimated at roughly $8,000 and a separate analysis put between $12,000 and $18,000.
How many companies were actually breached?
Gambit Security says at least 27 companies were compromised to varying degrees between September 10 and September 15, 2026, out of roughly 100 organizations targeted across the broader campaign that reportedly began in July.
What AI tools were used in the attack?
Three open-source AI agent frameworks: Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes for orchestration and post-exploitation tasks.
Were Anthropic, DeepSeek, or Moonshot AI directly involved?
Forbes reported the attacker’s agents drew on underlying models associated with those companies, but the available reporting does not indicate the companies’ own products or infrastructure were compromised or intentionally weaponized. The attacker used open-source orchestration tooling layered on top of commercially available models.
How does this compare to the average cost of a data breach?
IBM Security and the Ponemon Institute put the global average cost of a data breach at $4.44 million in their 2025 report, down slightly from $4.88 million the prior year. That means the cost asymmetry between attacker and victim, even using the higher $18,000 total campaign estimate, runs into hundreds-to-one territory.
Did AI and automation help or hurt companies in this scenario?
Both. IBM’s research found companies using AI and automation extensively in their own defenses averaged $3.84 million per breach versus $5.72 million for those that didn’t, even as the same underlying technology made attacks like this one dramatically cheaper to run.
What should retailers do right now?
Prioritize checkout-page script integrity monitoring, since skimmer injection was the primary monetization tactic in this campaign, alongside standard patch management and web application firewall coverage tuned to flag high-volume automated scanning rather than just known exploit signatures.
Is this the same story as other AI-agent breach headlines this week?
It stems from the same Gambit Security disclosure covering the Hermes, Strix, and Cairn toolchain and the 27-company breach count. This analysis focuses specifically on what the cost figures mean for attacker economics and the broader security market, rather than re-reporting the incident details themselves.
