A 100-company card-theft spree cost $8,000 in AI agents. That price is the real security story

A Chinese-speaking hacker ran a five-day campaign against more than 100 companies using agentic AI built on Anthropic's Claude, DeepSeek and Moonshot AI models, according to a report summarized by OODAloop. The targets clustered in retail, hospitality and health care, and the agents were mainly tasked with stealing customer credit card details. The reported cost of deploying the agents: $8,000. Security analysts cited in the report say the campaign could have resulted in the exfiltration of card details belonging to nearly 600,000 users. The full impact has not been measured, and this account rests on security analysis rather than on any charge or verdict — the attribution and the scale should be treated as claims, not established facts.

Our thesis: the figure that matters here is not 600,000, it is 8,000. Set them against each other and the operation cost roughly a cent and a half per exposed record. That is the entire story. Credential theft and card skimming are decades old; what agentic AI changes is the labor cost of running a campaign against a hundred separate targets at once, each with its own systems, defenses and quirks. That work used to require either a crew or months. Now, per this report, it is a five-day project and a mid-range laptop's worth of compute spend.

Two details deserve more attention than they will get. First, the attacker allegedly mixed models from three vendors across two jurisdictions — one US frontier lab and two Chinese ones. No single company's safety policy governs that stack, which is the practical answer to anyone who believes provider-side refusals are a security control. They are a speed bump; an attacker simply routes around them. Second, the targets were retail, hospitality and health care: not defense contractors, not banks, but the mid-sized operators with the thinnest security teams. Agentic attacks go where the marginal cost of one more victim is lowest, and that is the long tail.

Our read: this is consistent with what we have argued for months — the near-term danger from AI is not superintelligence, it is the industrialization of boring crime. That is a genuine short-term harm and it deserves to be named plainly. But the correct response is not to pretend the cost curve can be un-invented, and certainly not to treat open-weight models as the culprit when a closed frontier model appears in the same toolkit. The same collapse in cost works for defense: an agent that continuously audits every endpoint, rotates every credential and watches transaction velocity costs the same order of magnitude as the one attacking it. The asymmetry today is that attackers have already adopted it and most defenders have not. Closing that gap — plus friction where agents must touch the real world, at payment rails and credential issuance — is the work of the next two years.