Gambit Security discloses that open-source AI agents autonomously attacked e-commerce sites in Japan and abroad, with at least 27 companies compromised

After obtaining and investigating the attacker's relay server, security company Gambit Security found that three open-source AI tools—Hermes, Strix, and Cairn—were used in attacks on e-commerce websites, with most of the process from vulnerability discovery, intrusion, privilege escalation, to data theft completed autonomously by AI. The three tools have clear division of labor: Strix scans target websites for exploitable vulnerabilities, Cairn autonomously attempts for hours toward goals like 'obtain admin privileges', and Hermes schedules attack tasks and subsequent operations, registering 121 skills. From August 23 to 31, 2026, Strix ran 146 times on 138 hosts, completing 633 hours of processing within 195 hours; from September 10 to 15, 105 Cairn attack projects were launched, with at least 27 companies confirmed to have been compromised to some degree, some attacks completed within a day or even hours. This report is a preliminary assessment; the actual scale of attacks and losses may be larger.