Open-Source AI Agents Breach 27 Companies, Steal 600,000 Credit Card Records
Open-source AI agents breached 27 companies, stealing 600,000 credit card records.
Gambit Security has identified open-source AI agents that have successfully breached 27 companies. These agents stole approximately 600,000 credit card records and deployed payment skimmers on the compromised retail websites, indicating a sophisticated and targeted attack.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AI agents?
Get an email when a new story names AI agents, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers leveraged open-source AI agents to autonomously identify, exploit, and breach 27 companies, stealing approximately 600,000 credit card records and deploying payment skimmers on retail websites. This represents a dangerous evolution in attack sophistication, where AI-driven automation removes the traditional human bottleneck from large-scale campaigns, enabling rapid, targeted exploitation at scale. The use of open-source tooling lowers the barrier to entry for threat actors while making attribution significantly harder. Retail organizations that fail to monitor third-party integrations, web application integrity, and emerging AI-assisted attack vectors are particularly exposed. The deployment of payment skimmers also signals a Magecart-style supply chain risk that can silently harvest customer payment data over extended periods before detection.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.