Attackers used AI tools to gain full domain control for about $12

Gambit Security discovered a campaign in which a Chinese-speaking attacker used autonomous AI agents to hit 105 e-commerce sites over five days in September 2026, compromising at least 27 companies. The intrusion took payment card records from two companies, totaling no fewer than 600,000, and card skimmers appeared on five of the compromised sites. The remaining companies faced some level of illicit access, including at least one Fortune 500 firm.

Attackers paid an average of $25.46 for each completed target. The campaign used the Hermes agentic AI system along with the Strix and Cairn penetration-testing frameworks, Gambit Security said. The operation drew on three AI harnesses and on models that are both open-weight and public. Open-weight models are AI models whose internal weights are publicly available.

According to Sa’ar Elias of Gambit Security, a single person with minimal prior knowledge can now handle tasks that previously required a coordinated team of skilled attackers. Elias made the comment in reporting published Oct. 23, 2026. Elias said companies should focus on their minimum viable business processes and consider recovery economics. Elias said security budgets may need to grow to adapt to AI economics, and spending should reflect operational protection instead of counting threats or tools managed.

Independent reports describe autonomous AI agents carrying out large-scale website intrusions at low cost, which shifts the economics of cybercrime. Agentic AI has accelerated vulnerability research, contributing to a large increase in CVE assignments, Dark Reading reports. CVE assignments are identifiers given to publicly disclosed security flaws. Gambit Security found the September campaign, while Businesstechweekly and Reuters documented a later operation targeting over 1,200 company websites.

Colin Ferris of Silverfort said an orchestrating agent using publicly available Claude Opus models reached full domain control in eight minutes. That means the attacker gained complete administrative authority over a network domain. Ferris said AI agents often exploit accounts that have excessive privileges, shared login details, or unmanaged service accounts. The same agent hit dead ends 21 times and stopped after authentication and access controls were strengthened, and Ferris said stopping an attack at the access point costs less than fixing the damage later.

Flashpoint figures cited by Dark Reading show the average price of purchased initial access fell from just over $1,400 to $429 as underground market supply increased. Underground markets are online forums where criminals buy and sell access and data. Initial access is a foothold inside a victim’s network that attackers sell to others.

Ian Gray of Flashpoint said the price drop in initial access is where they measured it. He also said AI makes other parts of the attack chain faster and easier to scale. Flashpoint reported that companies paid ransoms in 28 percent of cases in the first half of 2026, while ransomware activity increased by 45 percent.

Albert Ziegler, CISO at XBOW, said attackers will target every internet-connected part of a company, including links to internet-connected partners. He said protecting only a few high-priority sites is not enough.

Businesstechweekly and Reuters reported on Oct. 21, 2026, about a campaign using autonomous AI agents targeting over 1,200 company websites. The operator behind it speaks Chinese. Snorre Fagerland of NorForge found the operation on Oct. 2, 2026, while scanning for exposed instances of Cairn. Fagerland published the findings on Oct. 20, 2026.

Reuters reviewed the attacker’s own records to confirm the victims. John Deere, SharkNinja, and Cummins were among the targets. Two smaller businesses confirmed compromise in the campaign documented by NorForge.

NorForge divided the exposed panels into three clusters and judged more than 20 to be probably malicious. AIA0001 is the leading cluster. It relies on Chinese and links 14 panels to more than 1,100 attack projects. The cluster aims for ongoing access to shopping and payment systems in the United States, Japan, and Australia.

Agents received a common instruction to execute code on a target shop. The instruction also called for deploying a web shell uploader, which lets an attacker place files on a compromised server. NorForge confirmed a live web shell at a large hardware-parts seller. NorForge confirmed a backend server exposure at a major US retailer caused by a vulnerable cookie setting.

Successful intrusions averaged slightly less than 23 hours, with an observed success rate of about 10 percent. NorForge estimated the cost at about $5 per task, including failures. Fagerland told Reuters that AI tokens cost roughly $5,000 for the operation, about $50 per successful intrusion. AI tokens are units of text that models process.

A worker called claudecode_deepseek-v4.1-flash executed every task in the AIA0001 cluster. NorForge and Reuters did not verify the models, but the naming suggests the attackers may have used DeepSeek V4.1 Flash through Anthropic’s Claude Code.

NorForge used Trufflehog on panel data and uncovered hundreds of exposed secrets, with 11 percent still valid when reviewed. Trufflehog is a tool that searches for secrets such as passwords and keys in code and configurations. Even if an intrusion fails, exposed panels disclose targets, weaknesses, credentials, and keys. A separate English-language cluster revealed the operators’ SSH logins for staging servers.

NorForge is working with Reuters to notify victims. It also asked hosting providers to remove exposed panels, and success depends on individual hosts. Businesstechweekly notes that this follows a September 2026 Gambit Security report involving a criminal who used Cairn with two other AI tools. The earlier operation stole credit-card data, and no sources link the two campaigns.

John Deere said it addressed the issue and saw no evidence that anyone accessed sensitive data. SharkNinja said the attack hit a standalone product-support site and they contained it. Cummins said it investigated a possible attack on a website operated by a vendor.

Legitimate penetration-testing firms left real client tests on unsecured panels, putting paying customers’ confidential data at risk. Businesstechweekly recommends checking port 8000 for unprotected panels and scanning for hidden upload forms. It also recommends applying Adobe’s hotfix for CVE-2026-75650 on Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9. The publication said organizations that treat patching as a periodic exercise instead of continuous discipline face measurably greater risk than twelve months ago.

The report says AI is now an operator rather than just an attack assistant. Check Point Research’s Annual AI Security Report 2026 was published July 14, 2026. AI performs hands-on work in live intrusions, Check Point said. Examples include China-nexus espionage and a criminal breach of multiple Mexican government agencies.

Check Point said a developer created VoidLink, an 88,000-line command-and-control framework, with an AI environment in under a week. A command-and-control framework is software attackers use to manage compromised systems. Most threat actors prefer jailbroken mainstream models, which have had their safety restrictions removed, to self-hosted ones.

Check Point said actors exploit agentic architecture by using a planted configuration file that an agent loads and trusts between sessions. Phishing-as-a-service kits, ready-made tools for launching phishing campaigns, embed language models with built-in jailbreaks. Conversational AI voice-agent services run vishing, or voice phishing to steal credentials, and one-time-passcode theft at scale.

Check Point said detections of longer malicious payloads rose roughly fivefold between March and May 2026. Those detections approached 1 percent of observed prompts in May, indicating growing indirect prompt injection. Indirect prompt injection hides malicious instructions in data an AI system processes.

High-risk GenAI prompts doubled over the last year, going from 2 percent to 4 percent, according to the July 14 report. Organizations averaged 10 AI applications per month, with many lacking approval. Business Services recorded the highest rate of high-risk GenAI prompts, at 5.91 percent. Nearly one in every 17 AI interactions carried significant data-exposure risk.