A $8,000 agent swarm allegedly hit 100 companies — the cost asymmetry is the security story

A Chinese-speaking hacker ran a five-day campaign using agentic AI powered by Anthropic's Claude, DeepSeek and Moonshot AI, according to a brief published by OODA Loop on September 23. The agents targeted more than 100 companies, mostly in retail, hospitality and healthcare, and were primarily tasked with stealing customer credit card details. OODA reports the total cost of deploying the agents at around $8,000. Security analysts cited in the item say the campaign could have exfiltrated card details for close to 600,000 users; the brief states the actual impact has not yet been measured.

Two caveats before drawing conclusions. This is a short secondhand summary pointing to a fuller report, the analyst estimate of 600,000 records is a ceiling rather than a confirmed count, and no victim has publicly confirmed the figures. We are reporting an allegation as an allegation.

Even discounted, the economics are the point. Roughly $8,000 in model spend against 100-plus targets across three sectors in five days is a labor-cost collapse, not a new exploit class. The techniques here are ordinary credential and card theft; what changed is that the reconnaissance, adaptation and grinding that used to require a skilled team now runs unattended. That inverts the usual defender's advantage, which has always rested on attacker time being scarce.

The multi-vendor detail deserves more attention than it will get. The attacker reportedly stitched together an American model and two Chinese ones. That defeats the implicit assumption behind most current safety policy — that each lab gating its own model meaningfully gates the capability. It does not, if the workflow can be split across providers so no single one sees the whole operation. Abuse detection built per-vendor cannot see a campaign assembled across vendors.

Our reading: this is the near-term AI risk that actually has a body count in dollars, and it is arriving while the legislative energy in Washington is pointed at superintelligence bans and existential scenarios. Automated fraud at industrial scale is measurable, attributable and addressable today — through credential hygiene, card-data tokenization, anomaly detection tuned for machine-speed reconnaissance, and cross-provider abuse sharing between labs that currently compete rather than coordinate. None of that requires new philosophy. It requires treating the agent as an adversary's force multiplier rather than only as a product feature, and accepting that the same autonomy that makes an agent useful to a developer makes it useful to whoever is on the other side.