{"schema_version":"0.8.0","id":"LR-2026-0133","record_version":5,"title":"Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card data","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-07","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"Strix, Cairn, Hermes","tools_granted":["vulnerability_scanning","exploitation","code_execution","credential_access","database_access","file_upload","cloud_storage_write"],"permissions_scope":null,"autonomy_level":"supervised-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":"production","integration_type":"agentic_with_tools","intended_use":"Autonomous penetration testing and exploitation of online retail websites","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-07","incident_class":"security_compromise","failure_class":"harmful_compliance","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Autonomous AI agents (Strix, Cairn, Hermes) were used by attackers to scan and compromise hundreds of online retail sites, stealing over 600,000 credit card details and installing payment skimmers. Gambit Security detected the campaign through leaked data, attacker tools, and website skimmers. The report notes the actual scale may be larger.","tags":["autonomous-agents","cyberattack","credit-card-theft","skimmers","japan"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"a source states the agent carried out a harmful instruction it was given by its principal","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":617938,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies.","harm_class":[],"affected_description":"over 600,000 valid credit card details stolen from just two companies; at least 27 companies compromised; more than 100 sites infected with skimmers","protected_class_involved":null,"data_categories_exposed":["credit_card_numbers","credentials","pii"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://gigazine.net/gsc_news/en/20261007-ai-agents-autonomous-attack/","publisher":"news search (Google News index)","date":"2026-10-07","type":"press","title":"The terrifying reality of fully automated methods of hacking and personal data leaks, where autonomous AI agents continuously attack hundreds of online sites for as little as 4,000 yen per attack, has been brought to light.","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"C","system.autonomy_level":"D","system.developer":"D","system.deployment_context":"D","event.failure_class":"D","event.tags":"D","event.adversarial_actor":"D","event.agent_involved":"C","event.detection_method":"D","event.summary":"D","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.records_exposed":"C","impact.affected_description":"C","impact.data_categories_exposed":"D","impact.severity":"D","context.industry":"D","context.denominator":"C","context.denominator_available":"D","context.country":"C","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"According to Gambit Security, the three tools each had a different role."}],"system.tools_granted":[{"source_index":0,"quote":"In one confirmed attack, the attacker first exploited a SQL injection vulnerability in a web application to access the database, read the one-time passwords stored there, and bypassed multi-factor authentication."}],"system.autonomy_level":[{"source_index":0,"quote":"In the system confirmed this time, a human selects the target and provides a simple objective, while the AI continues trial and error for extended periods."}],"system.lifecycle_stage":[{"source_index":0,"quote":"The targets were not chosen randomly. The attackers extracted shopping sites from website access ranking services, excluded sites using major e-commerce platforms, and then focused on stores using custom-developed systems that were likely to have unknown vulnerabilities or configuration flaws."}],"system.integration_type":[{"source_index":0,"quote":"Cairn, given objectives such as 'gaining administrator privileges' and 'making it possible to execute code on the server,' would autonomously continue the attack for several hours, trying various intrusion methods."}],"system.intended_use":[{"source_index":0,"quote":"Strix would examine the target website and look for vulnerabilities that could be used for intrusion."}],"event.failure_class":[{"source_index":0,"quote":"Cairn, given objectives such as 'gaining administrator privileges' and 'making it possible to execute code on the server,' would autonomously continue the attack for several hours, trying various intrusion methods."}],"event.detection_method":[{"source_index":0,"quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies."}],"event.summary":[{"source_index":0,"quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies."}],"event.tags":[{"source_index":0,"quote":"The terrifying reality of fully automated methods of hacking and personal data leaks, where autonomous AI agents continuously attack hundreds of online sites for as little as 4,000 yen per attack, has been brought to light."}],"event.adversarial_actor":[{"source_index":0,"quote":"The terrifying reality of fully automated methods of hacking and personal data leaks, where autonomous AI agents continuously attack hundreds of online sites for as little as 4,000 yen per attack, has been brought to light."}],"event.incident_class":[{"source_index":0,"quote":"The terrifying reality of fully automated methods of hacking and personal data leaks, where autonomous AI agents continuously attack hundreds of online sites for as little as 4,000 yen per attack, has been brought to light."}],"event.agent_involved":[{"source_index":0,"quote":"Cairn, given objectives such as 'gaining administrator privileges' and 'making it possible to execute code on the server,' would autonomously continue the attack for several hours, trying various intrusion methods."}],"impact.records_exposed":[{"source_index":0,"quote":"The following is a breakdown of the leaked credit card information by country of issue, with 488,372 out of a total of 617,938 cards (79.0%) being issued in the United States."}],"impact.affected_description":[{"source_index":0,"quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies."}],"impact.severity_because":[{"source_index":0,"quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies."}],"context.industry":[{"source_index":0,"quote":"The targets were not chosen randomly. The attackers extracted shopping sites from website access ranking services, excluded sites using major e-commerce platforms, and then focused on stores using custom-developed systems that were likely to have unknown vulnerabilities or configuration flaws."}],"context.country":[{"source_index":0,"quote":"A series of incidents have occurred in which Japanese companies, including"}],"impact.severity":[{"source_index":0,"quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-07"}],"context.denominator":[{"source_index":0,"quote":"Strix alone was executed 146 times on 138 hosts between August 23rd and 31st, 2026, running multiple scans in parallel and completing a total of 633 hours of processing in just 195 hours."}]},"notes_on_gaps":"No source states the model name, version, developer, permissions scope, guardrails present, deployment context, production intent, safeguard state, date occurred, date disclosed, duration, time to contain, date detected, near miss, root cause, responsible party, input provenance, operations paused, remediation, precursor events, direct loss USD, remediation hours, loss range, downstream exposure count, org size band, denominator, systemic exposure, shared model ID, upstream incident ID, incident evidence, regulatory, or coverage. Judgements: system.tools_granted, integration_type, lifecycle_stage, event.tags, impact.data_categories_exposed, impact.reversibility, context.industry are classified from behaviour with no explicit test; event.summary is aggregated from cited sentences; story steps are classified from the source's answers. event.trigger: human_misuse was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.tools_granted: classified from described behaviour. system.lifecycle_stage: production. system.integration_type: classified from described behaviour. system.autonomy_level: a source states the agent acted while a person watched or could stop it. system.developer: no source names the developer. system.deployment_context: no source states where it ran. event.tags: classified from described behaviour. event.adversarial_actor: external_attacker. event.detection_method: a source states an outside organisation (a vendor, a partner, a platform) noticed it first. event.summary: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. impact.data_categories_exposed: classified from described behaviour. impact.reversibility: partial. context.industry: classified from described behaviour. context.denominator: classified from described behaviour. context.denominator_available: classified from described behaviour. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric; source gives a bound, not an exact count] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; the sentence that states the denominator was cited] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":"Retail","org_size_band":null,"country":"JP","denominator_available":true,"denominator":{"value":138.0,"unit":"other","period":"2026-08-23 to 2026-08-31"},"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Autonomous AI agents (Strix, Cairn, Hermes) were used by attackers to scan and exploit online retail websites, with tools for vulnerability scanning, code execution, and data access.","quote":"Strix would examine the target website and look for vulnerabilities that could be used for intrusion.","source_index":0,"grade":"D"},{"step":"went_wrong","text":"The agents compromised websites, stole credit card data, and installed skimmers, breaching security boundaries of the targeted companies.","quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies.","source_index":0,"grade":"D"},{"step":"reached","text":"Over 600,000 credit card details from two companies, at least 27 companies compromised, and more than 100 sites infected with skimmers.","quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies.","source_index":0,"grade":"D"},{"step":"caught","text":"Gambit Security detected the campaign through leaked data, attacker tools, and website skimmers.","quote":"Gambit Security has confirmed that over 600,000 valid credit card details were stolen from just two companies.","source_index":0,"grade":"D"},{"step":"done","text":"The report notes the actual scale may be larger; no containment or remediation is described.","quote":"Gambit Security notes that this report is a preliminary assessment.","source_index":0,"grade":"D"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://gigazine.net/gsc_news/en/20261007-ai-agents-autonomous-attack/"]}}