An $8,000 agent swarm hit 100 companies: AI crime is now a procurement problem, not a moonshot

A Chinese-speaking hacker ran a five-day campaign using agentic AI — systems that plan and execute multi-step tasks on their own rather than answering a single prompt — built on top of Anthropic's Claude, DeepSeek and Moonshot AI, according to a report picked up by OODA Loop on 23 September. The agents targeted more than 100 companies, mostly in retail, hospitality and healthcare, and were tasked primarily with stealing customers' credit card details. Total cost of deploying the agents: about $8,000. Security analysts quoted in the report estimate the campaign could have exfiltrated card data belonging to nearly 600,000 users, though the actual impact has not yet been measured.

That last distinction matters and we will hold to it: 600,000 is an analyst ceiling on what was reachable, not a confirmed count of what was taken. The same discipline we apply to vendor benchmark claims applies to breach numbers — demonstrated is not the same as potential, and the gap is where panic gets manufactured.

The detail that deserves more attention than the headcount of victims is the shopping list. The attacker did not rely on one model. He mixed a US frontier system with two Chinese ones, presumably routing tasks to whichever was cheapest, most permissive or most available at each step. No single provider's safety policy could have stopped this campaign, because no single provider saw the whole campaign. Anthropic could have blocked its slice and the operation would have continued on the other two. This is the structural problem with per-vendor AI safety: abuse is now composed across suppliers, while detection is siloed inside each one.

Then there is the arithmetic. Eight thousand dollars across 100-plus targets is roughly $80 per company — less than a single hour of incident-response consulting, less than many firms spend annually per endpoint on security software. For years the implicit defence of mid-sized retailers and clinics was economic: a competent human attacker's time was too expensive to waste on them. Agents dissolve that shield. The sector mix in this campaign is the proof — retail, hospitality and healthcare are not the most valuable targets, they are the ones with the widest, most fragmented payment surfaces and the thinnest security staffing. Attackers went where the surface was widest, not where the sophistication was highest.

Our reading: this is the short-term risk we have flagged repeatedly, arriving on schedule. The near-term danger from agentic AI is not a runaway superintelligence; it is the industrialisation of ordinary crime — fraud, credential theft, card skimming — at a cost per target that collapses by an order of magnitude. Regulation aimed at hypothetical frontier catastrophe does nothing here. What would help is unglamorous and available today: cross-provider abuse telemetry so that a pattern rejected by one vendor is visible to the others, stronger identity checks on high-volume agentic API traffic, and inside companies the same architectural rule we have argued for elsewhere — let agents read and prepare, keep irreversible actions behind a human signature.

The long-term picture is not symmetrically bleak. The same automation that just made a 100-company campaign cost $8,000 will eventually make continuous security testing, patch triage and anomaly hunting affordable for the clinic and the hotel chain that could never staff a security operations centre. Defence gets the same cost collapse — it simply gets it later, because attackers adopt first and always have. That lag, measured in years, is the transition cost we should be honest about while we build the tooling that closes it.