A single Chinese-speaking operator chained three open-source AI harnesses into a near-autonomous intrusion pipeline, compromised at least 27 companies in five days, and paid an average of $25.46 per completed scan to do it. Gambit Security's threat intelligence team published the reconstruction this week after recovering the operator's staging server and working backward through the logs it held.
Victims named in Gambit's report include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and an online fashion retailer. From two companies alone, the agents pulled more than 600,000 unexpired credit card records, over 488,000 of them tied to US cardholders.
Key takeaways
- The best-documented stretch is September 10 to 15: 105 attack projects opened, at least 27 companies compromised to some degree, and intrusions that generally landed the same day they started.
- The operator's own cost review recorded a mean spend of $25.46 across 101 completed scans, ranging from $3.13 to $79.31; Gambit puts the full campaign bill at $12,000 to $18,000.
- Three separate harnesses split the work β Strix for vulnerability discovery, Cairn for exploitation, Hermes for orchestration β each running on a different commercial model through OpenRouter.
How the three harnesses divided the work
Hermes sat at the top as campaign orchestrator, an always-on AI agent that launched jobs, steered activity and wrote or edited its own skills. The operator loaded it with a Chinese-language persona titled "SOUL - Red Team Operator" and 121 skills, 78 of them attack-specific. One of those skills existed purely to strip the harness's own content filters.
Hermes ran on Anthropic's Claude Opus 4.6. Gambit noted that newer models refused the same requests, which makes the choice of an older release a deliberate guardrail workaround rather than a coincidence. Across 260 sessions the human typed 1,951 prompts in Chinese, most of them terse β read the vulnerability report, test the sudo password first, see whether the file upload gives code execution.
Strix handled reconnaissance through OpenRouter on GLM 5.2 and later DeepSeek v4 Pro. Its reconnaissance window ran August 23 to 31: 146 deep-mode passes over 138 hosts, logging 633 hours of scanner work inside 195 hours of real time. That overlap is the parallelism the economics depend on.
Cairn picked up from there on DeepSeek v4.1 Flash. Handed a domain and an objective β get a shell, get admin β it kept working until it succeeded, timed out, or a human stopped it.
What the agents actually did once inside
Gambit describes attack paths chosen in real time, producing different techniques at nearly every victim. One chain reads like a checklist. An injection flaw surfaced a one-time password sitting in plaintext, which opened a web panel. The agent planted a web shell there, spotted a sudo rule it could abuse, and left with AWS credentials β 46 secrets, 102KB in all.
The improvisation cut both ways. At one victim, a cleanup routine matched table names too broadly and dropped 180 tables β including the backups the organization had created β wiping administrator accounts outright. Skimmer deployment was ordered against at least 27 named victims and confirmed live on 19 sites, with more than 100 further infected websites traced by Gambit alongside independent researcher Varys. The report catalogs nine injection techniques, from appending to an existing JavaScript file to poisoning S3 buckets, Kubernetes initContainers and server-side page caches.
Why defenders should read the tempo, not the tooling
None of the individual techniques are new, and that is the point. Gambit's director of threat intelligence, Eyal Sela, wrote in the alert β first detailed by The Register β that the harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs. When exploitation lands within hours of exposure, he argued, patch speed stops being the only lever and recovery time becomes the real question.
The pattern matches what researchers have observed in controlled settings, where agents escalated to SQL injection after ordinary data requests failed. What changes here is economics: at roughly $25 a target, a lone operator can afford the volume that previously required a crew. Anthropic's model was the orchestrator of choice only until a newer version declined the work, which suggests refusal behavior is doing real defensive work β and that unpatched access to older weights undoes it.
FAQ
Which AI models did the attacker use?
Hermes ran on Anthropic's Claude Opus 4.6, Strix on GLM 5.2 and then DeepSeek v4 Pro, and Cairn on DeepSeek v4.1 Flash. All model access went through OpenRouter, whose account balance gave Gambit the spending figures.
How much did the campaign cost the operator?
An August 25 account balance showed $7,005.71 spent over the previous four weeks, after which activity continued for three more weeks at twice the daily volume of model calls. Gambit estimates the total at $12,000 to $18,000, against more than 600,000 stolen card records.
Are Strix, Cairn and Hermes malicious tools?
No. All three are open-source AI harnesses built for legitimate use, including autonomous penetration testing. The campaign misused them by supplying an attack persona and custom skills, including one that disabled a harness's own content filtering.
