Cases › security breach › LR-2026-0748
Open-source AI agents breach 27 companies and steal 600,000 card records
Preliminary Why: 1 report: Hackread · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: developer and model, could do, deployer.
Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: the source states at least 27 companies were compromised.
A financially motivated threat actor used three open-source AI harnesses, Strix, Cairn and Hermes, to run automated attacks against companies, mainly online retailers, with little manual input. Between September 10 and 15 the operator opened 105 attack projects and compromised at least 27 companies to varying degrees. The campaign resulted in more than 600,000 unexpired credit card records being exfiltrated from two companies. A Hermes skill also instructed the agent to clear payment data after card information was downloaded, and an automated cleanup routine at one victim dropped 180 tables. Researchers at Gambit Security recovered an exposed staging server that revealed the campaign. Gambit worked with the Shadowserver Foundation and industry partners to notify affected organisations and take down linked infrastructure.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Evidence
- Records exposed 600,000
- Other parties affected 27
No source states: a step-by-step account, when it happened, when it was found, the direct loss, any court case, the cause, what set it off, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
- September 10 and 15 Operator initiated 105 attack projects and compromised at least 27 companies.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
No direct financial loss is stated. The year for the September dates is inferred from the article date. Which two companies lost records is not stated. The 180-table cleanup was an automated routine, not stated as agent-driven. Remediations are not recorded because the takedown and notifications are not stated as changes to controls.
LR-2026-0748 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON