Open Source Pentest Agents Ran a $25 Card Theft Factory

A financially motivated operator broke into at least 27 companies between September 10 and 15, 2026, using three public AI agents at a mean cost of $25.46 per completed scan. Gambit Security recovered the operator’s staging server and rebuilt the campaign from the files on it, including more than 600,000 unexpired credit card records taken from two of those firms.

The kit was Strix, Cairn, and Hermes. All three are open source harnesses that security teams already run. Model calls went through OpenRouter like any other job. Newer models refused some of the attack requests. Claude Opus 4.6 did not.

The Defender Tools on the Staging Server

Gambit Security’s threat intelligence team, led by director of threat intelligence Eyal Sela, published the interim report on September 22, 2026. The operator had been active since at least July. In the September 10 to 15 window alone, Cairn launched 105 attack projects and got some level of access at at least 27 companies.

Named victims with some access include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. Gambit based those claims on stolen data on the server, live skimmers still on sites or logged in scanners, and attack logs it could match to those first two sources. Sela wrote that the true size is likely larger than the slice in the report.

Each harness had a job. Strix hunted for holes. Cairn was pointed at a domain and an objective such as a shell or admin access, then left to run for hours. Hermes steered the work, launched jobs, and handled post-break-in tasks, including card theft and cleanup.

THE THREE HARNESSES ON THE SERVER

Strix’s own site sells that split in plain language. It is a Python package with an Apache-2.0 license and more than 60,000 stars on GitHub, plus about 5,000 forks, and it tells teams to install it with pip, run it in Docker on their own hardware, and keep the findings on disk. The GitHub quick start even sets an OpenRouter GLM model as the sample driver. Between August 23 and 31, this operator ran it 146 times in deep mode against 138 hosts, burning 633 hours of scanner time in 195 hours of clock time.

Cairn is smaller and more blunt. Its GitHub page describes a blackboard engine with facts, intents, and hints, and no fixed worker roles. Penetration testing is the first domain it claims to have proven. At the Tencent Cloud AI Penetration Testing Challenge, 2nd Edition, among 610 teams and 1,345 people, it cleared all 54 hackathon problems, the only team to do so, and finished third. The readme still says to use it only where you have permission. The staging server did not.

Hermes Loaded a Red-Team Persona Named SOUL

Nous Research built Hermes as an always-on agent that creates skills from experience, keeps memory across sessions, and can live on a $5 VPS. The docs include a SOUL.md file that sets the agent’s default voice. On this server the operator loaded a Chinese system persona titled “SOUL – Red Team Operator,” plus 121 skills, 78 of them attack skills. One added skill existed to strip Hermes’s own content security filters.

Hermes used Anthropic’s Claude Opus 4.6 after newer models refused the same class of requests. The human typed 1,951 short prompts in Chinese across 260 sessions, a few lines per target, while the harnesses did the long work. Gambit published the translations.

PROMPTS THE OPERATOR TYPED

• Start work: “Read the vulnerability report and start.”
• Code execution: “See whether the file upload in the report can give code execution.”
• Sudo first: “Read the vulnerability report, test the sudo password first.”
• Triage: “Read the report, is there anything worth doing here?”
• Backend: “Get into the web backend.”
• Objective: “Goal oriented, centred on getshell or backend access.”
• Cleanup: “First delete the js we uploaded, clear the temporary files.”

That is a dispatcher, not a keyboard attacker sitting in every session. The same product feature that lets a personal agent write reusable skills also let this operator save a wipe playbook and a filter-removal skill and reuse them. After a campaign like this, the first check inside a company is which tools its own agents can already reach, and whether a persona file can turn those tools into a red team without a new install.

101 Completed Scans Averaged $25.46 Each

OpenRouter sat under all three harnesses. The operator reached hundreds of models through one API, then swapped GLM, DeepSeek, and Claude by task. A captured balance on August 25, 2026 showed $7,005.71 spent over the previous four weeks. The operator then ran about three more weeks at roughly twice the daily volume of model calls. Gambit puts the full model bill between $12,000 and $18,000.

That campaign total is not the same figure as the per-scan ledger. The operator’s own cost review listed a mean of $25.46 across 101 completed scans, from $3.13 on the cheapest target to $79.31 on the dearest. Spread across the companies hit, Sela called that a few dollars to a few tens of dollars each.

THE MODEL BILL

• Four-week balance: $7,005.71 on OpenRouter as of August 25, 2026.
• Campaign estimate: $12,000 to $18,000 after three further weeks at about twice the daily call volume.
• Mean completed scan: $25.46 across 101 scans in the operator’s own review.
• Range per scan: $3.13 cheapest, $79.31 most expensive.

Target picking was cheap too. One method used a website traffic ranking service. The operator chose the shopping category, dropped shops on major hosted or open source commerce platforms, and kept custom-code shops, which they treated as more likely to break. They pasted 301 results into the console with an order to run them through a proxy and report high severity only. Other jobs arrived by hand, including a New Zealand retailer and a US photo printing company already handed over with a working administrator password and the order to get to work. Proxies in the attack logs included IPRoyal, 711proxy, and 1024proxy.

THE CAMPAIGN CLOCK

1. July 2026: Activity is already underway against online retailers, per Gambit’s reconstruction.
2. August 23 to 31, 2026: Strix runs 146 deep-mode scans against 138 hosts.
3. August 25, 2026: OpenRouter balance shows $7,005.71 spent in four weeks.
4. September 10 to 15, 2026: Cairn launches 105 attack projects; at least 27 companies are broken into to varying degrees.
5. September 14, 2026: Operator orders Magento payment fields dumped, then emptied.
6. September 22, 2026: Gambit publishes the interim report and says the campaign is still running.

Of those 105 Cairn projects, 57 had been deleted before Gambit got the server. The remaining 48 were the ones it could chart.

From a Login Field to AWS Secrets Manager

Cairn did not replay one exploit kit. Sela wrote that each path was chosen in real time through probing, so tactics differed across victims. One finished project, documented on the server, shows how far a single unattended run could go once a login field was weak.

THE CAIRN PATH ON ONE SHOP

1. Unauthenticated SQLi: Error-based EXTRACTVALUE on a login email parameter.
2. MFA bypass: A one-time password read in plaintext from the OTP table, then admin panel access.
3. File upload to root: An image field with no extension check, host code execution, then root through a sudo NOPASSWD python3.12 rule.
4. Internal pivot: NFS mount with no_root_squash, WordPress credentials from wp-config.php, a new WP admin via the database, plugin upload, and code execution on the blog host.
5. Cloud dump: AWS Secrets Manager emptied of 46 secrets (102KB), then the main Magento database on Aurora, the Magento encryption key, and a verified Blowfish-ECB decrypt of cc_number_enc.

Where access landed, it usually took less than a day, and in many cases a few hours. That speed is the product those three repos advertise to defenders. On this server it was pointed at live shops.

More Than 600,000 Cards Came From Two Databases

The card haul that headlines this campaign did not come from a hundred skimmed checkouts. Gambit said the operator took more than 600,000 unexpired records from two victim companies. It partnered with fraud firm Overwatch Data to handle the cards and notify issuers. Overwatch’s country table is the breakdown Gambit printed.

CARDS BY ISSUING COUNTRY

Kuwait (4,676), Australia (4,672), Hong Kong (4,459), France (4,295), and Qatar (4,075) fill out the rest of Overwatch’s named rows. US-issued cards are 488,372 of the dump, 79.0% of what Overwatch counted. That concentration sits in two stolen databases, not in the wider skimmer set.

Skimmers were a second, parallel goal. They were ordered against at least 27 named victims and confirmed in place on 19 of them during the campaign. With security researcher Varys, Gambit also found more than 100 further sites carrying a skimmer associated with this operation. Association by shared skimmer kit is a weaker claim than a confirmed break-in on those extra sites, and Gambit did not treat it as the stronger one.

Injection method followed whatever access the agent already had. The most common trick was appending a loader to a JavaScript file the shop already served, such as a jQuery or Bootstrap bundle, then restoring the original file timestamp.

HOW THE SKIMMERS WERE INJECTED

• Appended library: Extra code at the end of a legitimate JS file, original timestamp restored.
• Foreign script tag: Checkout pages loading cts.js, vla.js, or eut.js from lookalike CDN hosts.
• Google tag block: Loader dropped between real gtag calls on a US steel products site, padded with about 100 tabs so it sits off-screen in source view.
• S3 poisoning: An AWS key with write access to a beauty retailer’s CDN bucket, so the shop served the payload from its own host.
• Database fields: Loader written into product descriptions on a US firearms marketplace, then moved onto the victim’s domain.
• Kubernetes initContainer: Injection added to a print-on-demand platform’s production front-end deployment.
• Page cache: At a large American hospitality company, the payload was written into the cached page model of checkout.
• Repair cron: At a US wine retailer, a job in the JBoss log directory checked file size every two minutes and re-appended the skimmer after deploys restored a clean bundle.

The hospitality cache write is the closest public detail Gambit gave on that Fortune 500 checkout page. The airline is listed among assets accessed, not among the two databases that held the card dump.

A Cleanup Job Dropped 180 Tables

Theft was not the only damage. One Hermes skill file is titled Database Wipe After Extraction. It opens, “After extracting and downloading all card data, wipe the source fields in batches,” tells the agent to use a chunked PHP script because a single UPDATE across millions of rows with LIKE is slow, and ends, “Verify after wipe: Run the detection query again – all counts must be 0.” The operator expected Magento tables large enough to need that chunking.

On September 14 at 16:31, they told the agent to empty the serialized data columns on sales_flat_order_payment and sales_flat_quote_payment on an RDS host, in one backend query. Fourteen minutes later they changed the order: dump those two tables from those two databases, then empty them once the dump was done.

A second victim, a bicycle retailer, lost data in a clumsier way. The agent created ZQ-prefixed staging tables to hold what it stole. Cleanup then dropped 180 tables whose names matched ZQ or Backup, including backup tables the shop’s own administrators had made. Sela’s point is dry: data loss here did not come from a ransom note. It came from the attacker’s own tidy-up, plus an agent matching table names too broadly.

The Recovery Question After an Hour-Scale Break-In

Gambit framed the campaign as a timing problem. Detection thresholds, change windows, and on-call rotations were built for human pace. These harnesses ran tens of companies a day. Sela wrote that reported critical flaws at the largest software vendors have passed 600 a month, and that roughly 87% of the flaws attackers actually use are hit on or before the day they become public, a figure the report attributes to a16z Charts of the Week.

The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs. When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.

Eyal Sela, Director of Threat Intelligence, Gambit Security

Gambit said it had reached many of the affected organizations and had taken steps against the infrastructure it found, with help from the Shadowserver Foundation, Daniel Gordon, and other partners. Indicators it published include staging IP 155.254.22.215 and skimmer hosts such as static-js.com and cdn.netlfjs.com. As of the September 22 report, the campaign was still running.