Hacker Used AI Agents to Steal 600,000 Credit Cards
A single hacker used open-source AI agents to break into online stores, plant card skimmers on their checkout pages, and steal more than 600,000 credit cards — mostly just typing short commands while the AI did the hacking.
Gambit Security uncovered the campaign after finding the hacker's exposed server. It has been running since at least July 2026.
How it worked
The hacker chained three AI tools together: Strix found weak spots, Cairn broke in, and Hermes ran the whole operation. They ran on GLM 5.2, DeepSeek and Anthropic's Claude Opus 4.6 — which, according to Gambit, the hacker switched to after newer models refused the requests.
Once inside, the agents hid code on checkout pages that copied card details as customers typed them.
Who was hit
In just five days (September 10–15), the agents broke into at least 27 companies, including a Fortune 500 hospitality company and a major U.S. airline. Over 100 websites were infected, and more than 600,000 cards were stolen from just two companies — about 79% of them American.
Each attack cost the hacker only about $25 in AI usage.
The hacker has not been named or arrested. Gambit is working with partners to warn victims and take the hacker's servers offline.
How to protect yourself
Use Apple Pay or Google Pay — you never type your card number, so there's nothing to copy Turn on instant transaction alerts in your banking app Watch for small charges you don't recognize