One Hacker, Three AI Vendors, $8,000: Agentic Attacks Just Lost Their Cost Ceiling

A single Chinese-speaking attacker ran a five-day campaign against more than 100 companies using agents built on three different AI stacks — Anthropic's Claude, DeepSeek and Moonshot AI — according to a brief published by OODA Loop. The agents were mainly tasked with harvesting customers' credit card details, and most of the targets were in retail, hospitality and healthcare. The reported cost of deploying them: $8,000. Security analysts cited in the report say the campaign could have exfiltrated card data belonging to nearly 600,000 users; the brief is explicit that the real impact has not yet been measured.

Do the arithmetic on the reported figures and you get the actual story. Eight thousand dollars across 100-plus targets is under $80 per company. Measured against the 600,000-record ceiling analysts consider possible, it is under one and a half cents per stolen card. Cost, not capability, was historically what capped the scale of cybercrime: skilled operators are scarce, they work serially, and they cost real money. Agentic tooling removes that cap. The campaign did not need a better hacker — it needed a hacker willing to spend the price of a mid-range laptop and let software work a hundred targets in parallel for five days.

The detail most readers will skip is the one that matters most structurally: three vendors, two jurisdictions, a mix of Western closed APIs and Chinese models. The operator treated frontier AI as a procurement portfolio, not a product. That breaks the implicit assumption behind lab-level safety policy — that refusing a request at the model is a meaningful barrier. It is not a barrier when the workload can be decomposed and the refusal-prone steps routed to whichever vendor is most permissive that day. It is a speed bump with a bypass. This matches the pattern we flagged in Google GTIG's documentation of an autonomous credential-theft operation planned and executed in six hours: the model layer is where abuse gets detected and banned afterwards, not where it gets prevented.

The caveats deserve equal billing. This is a short intelligence brief, not a forensic report — no named victims, no technical detail on how the agents were orchestrated, no confirmed loss figure. "Chinese-speaking" is a language attribution, not a state one; nothing in the material supports reading this as state-directed, and the distinction is not pedantic, because commercial card fraud and state espionage demand completely different responses. And the three vendors named are suppliers of a tool that was abused; the brief accuses none of them of wrongdoing.

Our reading: this is what the short-term cost of the agentic transition looks like, and it lands hardest on precisely the sectors least equipped to absorb it. Retail, hospitality and healthcare run thin security budgets on top of enormous stores of payment and personal data. Expect more of this before less. But the conclusion we reject is that the fix is to slow the models down. The same economics cut both ways — $8,000 of agent time also buys continuous automated red-teaming for a mid-sized company, which was unaffordable eighteen months ago. The durable defences are architectural, not moral: runtime observability of what agents actually do, consumption telemetry customers can audit themselves (if you cannot see what your agents spend, fraud is invisible by design), and moving value off the reusable credential entirely through tokenisation and passkeys, so that a stolen card number is worth close to nothing.

The long view has not changed. Agents that compress the cost of diagnosis and drug discovery compress the cost of fraud too — it is the same dividend aimed at a different target, and the destination is still a world with less disease and more abundance. But that destination is reached through a transition governed on evidence rather than panic, and this week's evidence is a single number. Eight thousand dollars. Any institution that files it as an anomaly rather than the new baseline price of being attacked is the one whose name appears in the next brief.