Gambit discloses AI agents attacking hundreds of retail websites and stealing payment card data

Gambit Security's interim investigation, based on attacker server data and partial in-the-wild verification, states that three open-source AI execution frameworks carried out most of the attack chain in a campaign compromising retail websites. The report documents 105 attack projects launched from September 10 to 15, with at least 27 organizations compromised to varying degrees; data from two organizations involved over 600,000 unexpired payment card records, and card-skimming scripts were confirmed on 19 websites. The report also notes that when agents cleaned data, the matching scope was too broad, accidentally deleting a retailer's administrator backup. Some impact figures come from attacker logs and AI self-reports, and victim companies were not named; the campaign still being ongoing was the assessment at the time of the report's release.