What happened
Attacker-operated agents scanned retailers, selected exploitation paths, stole payment-card data, installed skimmers, maintained access, and executed cleanup actions.
2026-09-10
CriticalPrimaryAutonomous AI Agents Compromised at Least 27 Retailers and Stole More Than 600,000 Payment-Card Records
Gambit Security reports attacker-operated AI agents compromised at least 27 retailers, stole more than 600,000 payment-card records, deployed skimmers, and destroyed victim data.
Open-source AI agent harnessesCredential exposureAttacker-operated autonomous agents conducting retail intrusion, payment-data theft, persistence, and cleanupOnline retailers, storefront code, payment data, credentials, and victim infrastructure
Why it matters
At least 27 companies were compromised; more than 600,000 unexpired payment-card records were stolen, five websites received skimmers, and one cleanup routine destroyed victim data.
Missing authorization check
Independent authorization for payment-data reads, storefront changes, privileged credential use, and destructive operations.
Would PP block it?
At an integrated boundary, payment-data export, storefront mutation, credential-backed administration, and cleanup could require a receipt bound to the identity, resource, action, and expiry. The source does not establish such controls at the victims.
Incident analysis
Timeline and technical read
Timeline
2026-09-10
The documented six-day campaign burst begins.
2026-09-15
By the end of the burst, 105 projects have been launched and at least 27 companies compromised.
2026-09-22
Gambit publishes its analysis and verified impact.
Technical breakdown
- The operator launched high-level projects while three harnesses performed most of the attack chain.
- Agents probed targets and selected exploitation paths in real time.
- Gambit reports card-data theft from two companies and skimmers on five websites.
- One agent cleanup routine destroyed victim data.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Payment-data access, storefront deployment, privileged administration, credential use, and destructive mutation boundaries
- Still needs
- Initial exploitation, internet scanning, external agent planning, malware on ungoverned hosts, and paths bypassing an integrated gate remain outside coverage.
- Receipt required for
- Reading or exporting payment-card data, changing storefront scripts, using privileged credentials, and deleting production data
Permission Protocol is not a perimeter defense and would not prevent the initial exploit. It could constrain covered downstream actions only where a retailer had integrated an external fail-closed gate.
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.