{"id":61422,"date":"2026-09-24T23:32:15","date_gmt":"2026-09-24T23:32:15","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5299012"},"modified":"2026-09-24T23:32:15","modified_gmt":"2026-09-24T23:32:15","slug":"crook-used-three-open-source-agents-to-break-into-a-fortune-500-hospitality-company-a-major-us-airline-and-25-other-orgs","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/crook-used-three-open-source-agents-to-break-into-a-fortune-500-hospitality-company-a-major-us-airline-and-25-other-orgs\/","title":{"rendered":"Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs"},"content":{"rendered":"
<\/div>\n
<\/p>\n

security <\/p>\n

<\/a> <\/p>\n

Operator\u2019s AI bill averaged just $25 per completed scan <\/p>\n<\/p><\/div>\n

<\/p>\n

A crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers – and all at trivial cost.<\/p>\n

AI security company Gambit recovered the human operator\u2019s staging server, and used that access to reconstruct the data-theft campaign, whose victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. <\/p>\n

Between September 10 and September 15, the crook launched at least 105 attacks, and compromised, \u201cto varying degrees,\u201d at least 27 companies, Gambit director of threat intelligence Eyal Sela wrote<\/a> in a Tuesday alert.<\/p>\n

The Chinese-speaking operator used three different open source AI harnesses – Strix, Cairn, and Hermes – to run the near-autonomous attacks and hit \u201ctens\u201d of companies each day.<\/p>\n

\u201cWhere access was achieved, it usually took less than a day, and in many cases just a few hours,\u201d Sela wrote. \u201cWe also detected instructions in the attacker\u2019s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent – and this has indeed happened in some of the breaches.\u201d<\/p>\n

The operator also used OpenRouter for AI model access, and according to an August 25 account balance, they spent $7,005.71 over the previous four weeks. They then continued with the attacks for three more weeks, and operated at twice the daily volume of model calls. Gambit estimates the total cost of the campaign sits somewhere between $12,000 and $18,000. The operator’s own cost review put their mean spend at $25.46 across 101 completed scans. The cheapest scan cost just $3.13, with the most expensive racking up a bill for $79.31.<\/p>\n

Each of the three AI harnesses played a different role, with Hermes acting as the campaign orchestrator. The always-on AI assistant acts independently to execute multi-step tasks and manage workflows, and it can write and edit its own skills.<\/p>\n

The human operator loaded a Chinese system persona titled \u201cSOUL – Red Team Operator\u201d on Hermes with 121 skills. Of those, 78 were attack skills. One of the skills even removed the content security filters of the AI harness.<\/p>\n

Hermes used Anthropic\u2019s Claude Opus 4.6 – Gambit reports that newer models refused the attack requests – and the human operator typed 1,951 prompts in Chinese across 260 sessions. The prompts, translated into English, include the following: <\/p>\n