One attacker, three AI vendors, $8,000: the agentic fraud economy is now cheaper than the defense

According to an OODA Loop brief published September 23, a Chinese-speaking hacker ran a five-day campaign using agentic AI built on Anthropic's Claude, DeepSeek and Moonshot AI, targeting more than 100 companies — mostly in retail, hospitality and health care — primarily to steal customers' credit card details. The reported cost of running the agents was about $8,000. Security analysts cited in the brief estimate the campaign could have exfiltrated card data belonging to nearly 600,000 users. The full impact, the brief notes, has not yet been measured.

Treat the numbers as preliminary. This is a short brief pointing at a fuller report, the damage figure is an analyst estimate rather than a confirmed count, and "Chinese-speaking" describes the operator's language, not a state sponsor. We are not making the second claim, and neither is the source.

What is solid enough to reason about is the economics and the architecture. Eight thousand dollars is less than a single mid-level security hire costs in a month, and it bought coverage of more than a hundred targets in five days. The asymmetry has flipped: automating the attack is now cheaper than staffing the defense, and the targeted sectors — retail, hospitality, health care — are precisely those running large payment estates on thin security budgets.

The detail defenders should sit with is the vendor mix. The operator stitched together Western and Chinese models in one workflow. That makes any single provider's usage policy, abuse detection or export restriction a partial control at best; block one and the pipeline reroutes. Containment cannot live inside one lab's trust-and-safety team when the attacker treats models as interchangeable components.

Our read: we keep arguing that the near-term AI risk is not a distant superintelligence but the industrialization of ordinary crime, and this is what that looks like in practice — no novel exploit, just fraud at machine throughput and near-zero marginal cost. The defensive answer is the same capability pointed the other way, which is why gating advanced models behind verified-practitioner programs matters: defenders need parity of access, not just attackers. Short term this gets worse before it gets better, and the honest thing to say is that the card details of a lot of people are the cost of that lag.