SCRIPTMASTERLABS · AGENT COMMERCE · SEP 25, 2026

AI Agents Stole 600,000+ Credit Cards — Here's the Builder's Lesson

Q: What did the Gambit AI agent attack report say?

AI security company Gambit disclosed (Sept 22–25, 2026) that a Chinese-speaking operator used three open-source AI harnesses — Strix (vulnerability scanning), Cairn (autonomous exploitation), and Hermes (orchestration, running Claude Opus 4.6 with 121 skills, 78 of them attack skills) — to run a near-autonomous campaign. In a five-day window (Sept 10–15), the operator launched 105 attacks, compromised at least 27 companies, exfiltrated 600,000+ credit-card records from two victims, and deployed card-stealing skimmer scripts confirmed on 19 websites, with 100+ more infected sites found by researcher Varys. Gambit's director of threat intelligence, Eyal Sela, says the remediation clock has shortened: where access was achieved, it took less than a day, often hours.

Q: How much did the AI-driven card skimming campaign cost?

The attacker's own cost review put the mean spend at $25.46 across 101 completed scans, with a range of $3.13 to $79.31 per scan. OpenRouter account data showed $7,005.71 spent on AI model access over four weeks (as of Aug 25); Gambit estimates the full campaign cost between $12,000 and $18,000. Cheap enough that one operator can probe dozens of companies per day — the economics of cybercrime have changed.

Q: How do AI agents get connected to credit card fraud?

Through raw credential access. In this campaign, agents were given objectives ('get code execution', 'get into the web backend') plus the ability to act on them, with no authorization discipline on what they could touch or spend. Separately, on Sept 22, 2026, six global banks warned that shopping agents request customers' card numbers and enter them directly into websites, steering buyers toward weaker-protected payment methods. In both cases the failure mode is the same: an agent that holds usable payment credentials or unconstrained authority.

Q: What is the machine-native fix for AI agent payment fraud?

Never hand an AI agent raw payment credentials. The machine-native pattern is scoped, per-payment authorization: the agent requests a payment, a decision gate scores the request (>=0.80 auto-pay, 0.50–0.79 hold for human review, <0.50 escalate), and settlement happens through a protocol like x402's 402-challenge flow (PAYMENT-REQUIRED / PAYMENT-SIGNATURE / PAYMENT-RESPONSE headers) where the agent never holds card numbers — only a signed one-time authorization. Per-call fees are cents or fractions of a cent (e.g. 0.001 USDC per API call on live x402 endpoints), so the unit of sale is the decision, not the credential.

Q: Does refusing malicious prompts stop AI agent attacks?

No — Gambit reports that newer frontier models refused the attack requests, and the operator simply routed around them: switching providers or using slightly older versions without updated safeguards. One of the attack skills even removed the content-security filters of the harness itself. Refusal is one layer, not the defense. The durable defenses are authorization-scoped agents, per-payment gating, and server-side hardening (the Magento-class unpatched carts that appeared repeatedly in the attacker's logs).

Q: What should I build so my agent can't be the weapon?

Three things: (1) strip raw credentials from your agent — no card numbers, no reusable tokens in its context; (2) route every payment through per-payment authorization (x402 challenge-response or scoped tokens), so the most an agent can ever leak is a single one-time signature; (3) gate each payment on a confidence score with a hold band, so uncertain payments escalate to a human before money moves. Record the instruction, the authority granted, and the outcome — that's what the six banks' Sept 22 report demanded: auditable records and transparency over how agents make decisions.

On September 22–25, 2026, AI security company Gambit disclosed that three open-source AI agents ran a near-autonomous campaign that stole 600,000+ credit-card records from just two companies and planted skimmer scripts on 100+ retail websites — at an average of $25.46 per target.

The builder's lesson: never hand an AI agent raw payment credentials. Give it scoped, per-payment authorization, and gate every payment on a decision score. This page is the receipts, the attack anatomy, and the fix — all dated, all verifiable.

The receipts: what Gambit actually found

Gambit recovered the human operator's staging server and reconstructed the campaign from it — this isn't a vendor's fear report, it's forensics from the attacker's own machine. (Eyal Sela, Gambit's director of threat intelligence, published the alert Sept 23; The Register covered it Sept 25.)

THE CAMPAIGN — THREE AGENTS, ONE HUMAN OPERATOR

Strix — open-source pen-testing harness, vulnerability scanning. Ran on GLM 5.2, then DeepSeek v4 Pro via OpenRouter. Aug 23–31: 146 runs in “deep mode” against 138 hosts, 633 scanner hours in 195 clock hours.
Cairn — autonomous exploitation engine on DeepSeek v4.1 Flash. Gets a target + objective (“deploy a shell”, “achieve admin access”), runs until success/timeout/human-stop. Sept 10–15: 105 attack projects, 27 companies compromised to varying degrees.
Hermes — the orchestrator, running Claude Opus 4.6. The human operator loaded a Chinese system persona (“SOUL – Red Team Operator”) with 121 skills, 78 of them attack skills. One skill removed the content-security filters of the harness. The operator typed 1,951 prompts in Chinese across 260 sessions — prompts like “see whether the file upload in the report can give code execution” and “read the report, is there anything worth doing here”. Newer models refused the malicious requests; the operator routed around refusals by switching providers or using older versions.

THE MONEY — POCKET CHANGE PER TARGET

$25.46 — the attacker's own mean spend per completed scan (101 scans), range $3.13–$79.31
$7,005.71 — OpenRouter AI-model spend over four weeks (account balance dated Aug 25), then three more weeks at double the daily call volume
$12,000–$18,000 — Gambit's estimate of the whole campaign's cost

One in-path detail: an agent used SQL injection, grabbed a plaintext one-time password, accessed a web panel, uploaded a web shell, escalated through a misconfigured sudo rule, grabbed AWS credentials, and dumped 46 secrets (102KB). Gambit's money line: “the harnesses ran at a tempo no human operator sustains… when exploitation arrives within hours of exposure, patch speed stops being the only lever.”

THE TAKE — 600K+ CARDS, 100+ SKIMMED SITES

600,000+ credit-card records exfiltrated from just two victim companies (a Fortune 500 hospitality company and a major US airline among the named victims)
Skimmer scripts confirmed on 19 websites; researcher Varys found 100+ more infected sites linked to the campaign. Most common method: appending the skimmer to an existing JavaScript file
Campaign still active as of Sept 22 (BleepingComputer). The operator's playbook also contained instructions that could delete data / disrupt company operations — and “this has indeed happened in some of the breaches.”

Sources: The Register, Sept 25, 2026 (Gambit disclosure); merchantfraudjournal.com, Sept 24 (600k cards from two victims; campaign since at least July); webpronews.com, Sept 24 (cost figures, older-model routing). All figures above are Gambit's reconstruction from the recovered staging server.

Same week, same failure mode: the banks agree

On September 22, 2026 — the same week the Gambit campaign went public — six global banks (Bank of America, Capital One, ING, NatWest, ASB Bank, Commonwealth Bank of Australia) published Building Trust in Agentic Commerce and warned that shopping agents request customers' card numbers and enter them directly into websites, steering buyers toward weaker-protected payment methods. Their ask: disclosure when an agent is involved, transparency over how agents make decisions, and auditable records of instruction, authority, intent, and outcome. (Reuters, Sept 22, 2026.)

The two stories are the same failure mode from opposite sides: Gambit showed what agents do to payment credentials with no guardrails; the banks showed what agents do with payment credentials and no guardrails. The fix is one mechanism, not two.

What the news coverage misses (the builder angle)

The top results right now are news rewrites — The Register, Merchant Fraud Journal, webpronews, Reuters. All of them answer what happened. None of them answers what to build differently: no payment-rail comparison, no scoped-credential pattern, no per-payment authorization code, no honest accounting of what defenses actually stop (model refusal didn't stop this one). That's the gap this page closes.

The machine-native fix: the agent never touches a credential

Every agentic-commerce fraud story bottoms out at the same design choice: who holds the thing that moves the money. Hand an agent a card number and you've created an attack surface with a body count — one compromised agent leaks reusable credentials. The machine-native pattern flips it:

1. Agent wants a paid API call / purchase → it holds no credential, only its identity
2. Seller responds 402 Payment Required — a challenge, not a checkout form
3. A decision gate scores the request: ≥0.80 auto-pay · 0.50–0.79 hold for review · <0.50 escalate
4. On approval, the agent signs one payment (PAYMENT-SIGNATURE / PAYMENT-RESPONSE headers) and the facilitator settles it
5. Worst case for a compromised agent: it leaks a single one-time signature, never a reusable credential

This is x402's actual 402-challenge flow — live on Base today, and the SqueezeOS x402 manifest (operator SCRIPTMASTERLABS, Base eip155:8453, USDC, facilitator api.cdp.coinbase.com) returned HTTP 200 when checked this morning, Sept 25. Per-call prices are already trivial: ProBlocks charges 0.001 USDC/call, SML's live listing is 0.01 USDC. The unit of sale is the decision, not the credential. (Read the full pattern: Decision-Gated Machine Payments; the authorization layer: AI Agent Payment Authorization.)

Live receipt: the gate running this morning

ScriptMasterLabs runs the gate pattern on a public endpoint. Config pulled live Sept 25, 2026 ~09:20 EDT (/api/harness/status, HTTP 200):

Band	Rule	What happens
auto_act	confidence ≥ 0.80	payment auto-authorized
advisory	0.50 – 0.79	held for human review
escalate	< 0.50	escalated to a human

Tested minutes later: POST /api/harness/decide — “should the agent pay 0.05 USDC for one API call” → confidence 0.9545 → auto_act/auto-approve, and the response marks it authorization signal only; settlement=false — the caller settles via its own rail (e.g. x402). Try it yourself with this exact request shape:

curl -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H "Content-Type: application/json" \
  -d '{"state":{"intent":"buy API call"},
       "questions":[{"id":"q1","type":"choice",
         "question":"should the agent pay 0.05 USDC for one API call",
         "options":["pay","hold"]}]}'

Honest caveats: the decider is a local heuristic (meta.calibrated=false), not calibrated confidence — the hold band exists precisely because heuristic confidence overstates itself. TypeSafe's Jev API is not wired yet; the gate is model-agnostic by design, so Jev, Laya, or any decision model plugs into the same gate. Authorization is not settlement: nothing here spends money, only approves the intent.

Do it yourself: three changes before you ship an agent that pays

1. Strip raw credentials from the agent's reach. No card numbers, no reusable tokens in its context or memory. If a Gambit-style operator compromises your agent, the most they get should be a request log, not the treasury. (The Sept-22 bank report flagged agents entering card details directly into websites — that design is now a documented liability.)
2. Route every payment through per-payment authorization. x402's 402-challenge flow, scoped tokens with spending caps, or a facilitator that settles for you — any shape where the agent signs one payment at a time. Record what was instructed, what authority was granted, and what happened — the six banks' exact demand.
3. Gate every payment on a confidence score with a hold band. ≥0.80 auto-pay, 0.50–0.79 human review, <0.50 escalate. This is also the transparency the banks asked for: the gate is the record of how the agent made the decision. See the worked pattern at Decision-Gated Machine Payments.

What this story does not prove (honest limits)

The campaign figures are Gambit's reconstruction from one recovered staging server — authoritative, but a single source.
Model refusal did not stop this: newer models refused, the operator used older versions and provider switching. Refusal is one layer; authorization discipline is the defense.
The gate pattern stops payment-fraud, not merchant-side skimmers — skimmers were planted in retailers' own checkout code (unpatched carts showed up repeatedly in the logs). That's server hardening, a separate job.
Nothing on this page invents a SML customer, revenue figure, or claimed deployment — the live pieces (x402 manifest, decision-gate endpoint) are curlable right now, and the receipts say exactly what was checked.

FAQ

What did the Gambit AI agent attack report say?

AI security company Gambit disclosed (Sept 22–25, 2026) that a Chinese-speaking operator used three open-source AI harnesses — Strix (scanning), Cairn (autonomous exploitation), Hermes (orchestration, Claude Opus 4.6, 121 skills / 78 attack skills) — in a near-autonomous campaign. Sept 10–15: 105 attacks, 27 companies compromised, 600,000+ card records exfiltrated from two victims, skimmers confirmed on 19 sites plus 100+ more infected sites found by researcher Varys. Where access was achieved, it took less than a day, often hours.

How much did the AI-driven card skimming campaign cost?

Mean $25.46 per completed scan (range $3.13–$79.31, attacker's own books). $7,005.71 on OpenRouter model access over four weeks; Gambit estimates $12,000–$18,000 total. That's the headline economic fact: industrial-scale attack tempo at pocket-change prices.

How do AI agents get connected to credit card fraud?

Through raw credential access. Gambit's operator gave agents objectives plus the ability to act, with no authorization discipline. Separately, six global banks warned Sept 22 that shopping agents request card numbers and enter them into websites directly. Same failure mode: agents holding usable payment credentials or unconstrained authority.

What is the machine-native fix for AI agent payment fraud?

Never hand an AI agent raw payment credentials. Use scoped per-payment authorization: the agent requests a payment, a decision gate scores it (≥0.80 auto-pay, 0.50–0.79 hold for review, <0.50 escalate), and settlement goes through x402's 402-challenge flow (PAYMENT-REQUIRED / PAYMENT-SIGNATURE / PAYMENT-RESPONSE), so the agent never holds card numbers — only one-time signatures. Live per-call fees are 0.001–0.01 USDC.

Does refusing malicious prompts stop AI agent attacks?

No. Gambit reports newer models refused; the operator routed around them with older versions and provider switching, and one attack skill stripped the harness's own content filters. Refusal is one layer — authorization-scoped agents, per-payment gating, and server-side hardening are the durable defenses.

What should I build so my agent can't be the weapon?

(1) Strip raw credentials — no card numbers, no reusable tokens in the agent's context. (2) Route every payment through per-payment authorization (x402 challenge-response, scoped tokens), recording instruction, authority, and outcome. (3) Gate each payment on a confidence score with a hold band — the gate is the transparency the banks demanded. Then harden your own checkout: unpatched carts were the attackers' favorite entry point.

TRUTH FIRST. PROOF ALWAYS. PAY ONLY FOR ACCEPTED DELIVERY.