AI agents autonomously steal card data at 100+ companies: the cyberthreat Amodei and Altman already took for granted

By El Ecosistema Startup · September 23, 2026.

An automated cyberattack scheme compromised more than 100 companies and left skimmers —malicious code that intercepts card data at the moment of payment— active at 19 confirmed victims. According to the report cited by El Ecosistema Startup, investigators attributed the operation to actors linked to China, and it functioned as an autonomous chain: an agent receives a URL, scans for vulnerabilities, breaks into the system, extracts payment records and installs the skimmer, all without a human intervening between one step and the next. In at least two documented cases, the agents also ran cleanup routines that erased the victims' own access logs and backup tables, complicating both forensic investigation and subsequent regulatory notification.

This is not an isolated event. The most frequently cited precedent dates from July 2026: as CNN reported, a system coordinating up to eight AI agents carried out a four-day campaign against Taiwanese government agencies, mapped 21 systems, cracked 85 accounts and extracted 2,500 personnel records. The Israeli firm Dream, which discovered the attack, described it as the first documented case of a fully autonomous intrusion against a government, and summed up the shift with a line worth remembering: the cost of launching a competent attack has collapsed, but the cost of defending has not.

The news also comes in the same week that Dario Amodei (CEO of Anthropic) warned, as reported by El País, of a scenario six to twelve months out in which a swarm of agents could take control of entire segments of the internet. Sam Altman (OpenAI) took the same line: he said he does not see as distant the moment when open-weight models capable of causing serious harm exist. It is worth separating two planes here: the 100 companies and Taiwan are already demonstrated capability, with victims and forensics involved; the horizon described by Amodei and Altman is a projection from people who, it should be said, sell the very technology they describe as a threat. That the warning comes from inside does not invalidate it, but neither does it make it a done deal.

What we do have is real traffic data. An analysis by Check Point and Lakera AI Security covering the fourth quarter of 2025 found that 60% of attack attempts against AI agents sought to extract the system prompt (the internal instructions governing their behavior), 20% tried to evade security controls and 12% stayed in the reconnaissance phase. The important figure is not the percentage itself but what it reveals: the attack vector is no longer the answer the model gives, it is its entire reasoning flow, and detection rules designed for human behavior —hours of activity, geolocation, typing speed— lose validity against an agent that tries variants until it finds the one that works.

The market is already pricing this in. According to Cinco Días, in the week before the case came to light, Zscaler rose 20% over five sessions, CrowdStrike 18%, SentinelOne 17%, SailPoint 14%, Tenable 13%, Palo Alto Networks and Okta 11% each, and Fortinet 10%. Over six months, CrowdStrike and Palo Alto Networks more than doubled in value and are approaching market caps of $250 billion and $300 billion respectively. Bloomberg Intelligence argues that agent identity verification and agent-level monitoring are consolidating as spending priorities, and corporate activity backs that up: 426 mergers and acquisitions in cybersecurity in 2025 worth $92.5 billion (82% more than the previous year), with close to 200 transactions already recorded by mid-June 2026. That is where Google's purchase of Wiz ($32 billion) and Palo Alto Networks' acquisition of CyberArk ($25 billion) fit: both aim to secure the same ground, the stack where humans and agents with permissions now coexist.

Our take is that this case confirms an asymmetry we have been flagging for months: agentic offense is already autonomous and practically free to scale —a list of URLs and a day of waiting— while defense keeps reacting after the fact, shifting to the runtime and to behavior because the classic perimeter no longer works. For a startup that charges online, the relevant question is no longer whether it will be attacked but how long it takes to find out and how much it loses in the meantime; basic measures such as separating the payments bot from checkout in logs and backups, or enabling MFA (two-step verification) with no exceptions for access to the payment gateway, are no longer optional.

At the same time, this very capability —agents acting in a chain, without constant supervision, over complex systems— is what underpins the long-term promise we defend: automating drug discovery, accelerating scientific research, freeing human work for what really matters. The problem is not autonomy itself, it is that today it is being deployed faster on the attack side than on the protection side. The reasonable response is not to slow down the technology, it is what the market is already doing with its money: treating agent security the way the cloud was treated a decade ago, as critical infrastructure and not as a residual line item. It is the uncomfortable part of the transition, and one not worth glossing over, precisely so that the abundance that comes afterward is not built on broken foundations.