AI agents dropped the cost of breaching an online store to $25 — and defense is still priced for humans

A single attacker ran autonomous AI agents against hundreds of online stores at an average cost of $25.46 per target, according to research by Gambit Security reported by TechRadar. The campaign, active since July and still running on September 22, had produced more than 600,000 stolen payment records and left 119 websites carrying code designed to capture customers' card data. Victims cited in the research include a Fortune 500 hotel company, a major U.S. airline, an industrial distributor and an online fashion retailer.

The mechanics are less exotic than "autonomous agents" suggests. The attacker — described by Gambit as Chinese-speaking — supplied a web address and a general instruction; three coordinated tools, Strix, Cairn and Hermes, did the rest. One hunted for flaws, another tried to exploit them, the third orchestrated what came after. Hermes logged 1,951 human instructions across 260 sessions, which works out to a handful of commands per target. Between August 23 and 31, Strix alone ran 146 times against 138 different servers and accumulated 633 hours of probing; in September the campaign launched 105 attack waves in five days. When a way in existed, access usually came in under a day, and often in hours.

The number that matters is not 600,000. It is $25.46. Security economics has always rested on the price of an expert hour: attacking well took skill, patience and time, and that scarcity — not the strength of most defenses — is what kept smaller merchants unbothered. Gambit's logs show the attacker spent $7,005.71 on OpenRouter, a broker that resells access to language models, over roughly four weeks. That is the cost of one mid-level consultant for a few days, spread across hundreds of simultaneous, tireless intrusion attempts. We have argued before that the near-term danger of agentic AI is not superintelligence but the industrialization of ordinary crime. This is what that looks like with the invoices attached.

The defensive picture is equally instructive. The objective was a skimmer — code that quietly copies what you type at checkout — and the agents planted it wherever it would stick: legitimate JavaScript files, checkout pages, databases, caches, even Kubernetes deployments. In some cases scheduled tasks brought the malicious code back after it had been removed. Overwatch Data judged the stolen records unique and legitimate, and a payment processor reviewed a representative sample; roughly 488,000 of the cards, about 79% of the total, belong to U.S. holders. Gambit's warning is the operative line: companies must adapt to "a reality in which attacks are significantly faster and more exhaustive." Most patch cycles, triage queues and quarterly penetration tests were designed around an adversary who sleeps.

Our read: this is a repricing, not an apocalypse — and repricings are survivable if you notice them in time. The same capability that let one person accumulate 633 hours of reconnaissance in nine days will let a two-person security team run continuous adversarial testing against their own checkout flow, which was economically unthinkable a year ago. The asymmetry is real, but it is temporary only for those who actually adopt. Two things deserve watching. First, the inference bill is a signal: $7,005.71 in API spend is a paper trail that traditional crimeware never left, which makes the model-broker layer a genuine chokepoint for detection — and a governance question nobody has seriously legislated. Second, the named victims here are Fortune 500 companies with security budgets; the long tail of small merchants has none, and that is where the cost of this transition will actually land.

The long arc still points where we think it points. AI capable of auditing every line of code in a payment system is, eventually, AI that makes card fraud structurally hard. But that arrival is not automatic, and nothing about it is scheduled. The next two years are a race between attackers who have already automated and defenders who mostly have not — and this campaign is a fairly precise measurement of the current lead.