A Chinese-speaking hacker used AI agents to breach up to 100 companies within a five-day window this month, stealing more than 600,000 credit card records at a total operational cost of roughly $8,000, according to a Forbes report surfaced by cybersecurity firm Gambit Security2.
Gambit Security uncovered the campaign after the attacker accidentally left the server infrastructure used to carry out the attacks exposed on the open web. The hacker employed three off-the-shelf AI orchestration frameworks — Strix, Cairn, and Hermes — alongside Chinese AI systems DeepSeek and Kimi, and an older version of Anthropic's Claude model.
The compromised organizations included a Fortune 500 hospitality firm, a major U.S. airline, a large industrial supplies distributor, and an online fashion retailer. American cardholders accounted for approximately 79% of the stolen records.
ANALYSIS The roughly $8,000 price tag for a campaign that hit up to 100 companies and extracted more than 600,000 card records underscores how AI orchestration tooling can compress the cost and timeline of large-scale cyberattacks. The mix of Chinese-developed AI systems and a Western foundation model in a single attack chain illustrates that adversaries are assembling multi-vendor AI stacks, complicating any single provider's ability to enforce use-policy guardrails.