AI Agents Steal 488,372 US Credit Card Records and Infect 119 Retail Sites

Autonomous AI agents have compromised at least 119 retail websites to plant payment skimmers and steal hundreds of thousands of credit card records. According to cybersecurity firm Gambit Security, the campaign, which ran from July through at least September 22nd, utilized three open-source frameworks for scanning and exploitation. A human operator provided initial instructions, after which the AI agents operated largely independently. The breach resulted in the theft of over 600,000 credit card details, including 488,372 belonging to US customers, with the attacker spending between $12,000 and $18,000 on AI costs to execute the operation.