Should we stop evaluating agentic pentest tools?

No. The tools work, and a criminal using one says nothing about its value against your own assets with authorization. What the campaign should change is whether your runs produce an attributable record of which identity ran which scope.

Did the AI find new vulnerabilities?

The reporting describes ordinary web application flaws, found and exploited at volume. The autonomy is in the labour, not the discovery.

Is $25.46 the real cost of breaching a company?

It is the mean cost of a completed scan, not of a successful breach. A scan that finds nothing still costs money, and 101 scans produced 27 compromises. The honest reading is that attempts became cheap enough that the hit rate stopped mattering.

How would we know if an internal agent went outside its authorized scope?

Only from a record that ties each outbound model call to the person who authorized the run and the scope they authorized. A shared service account cannot produce that, because every call looks identical.

One Operator Spent $25.46 a Scan Chaining Three Open-Source Agent Tools Into 27 Breaches

Gambit Security put a number on autonomous exploitation that I had not seen before: a mean of $25.46 across 101 completed scans, with total operator spend between $12,000 and $18,000 over seven weeks. For that money, a single operator compromised at least 27 companies between September 10 and 15, including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer. Skimmers were confirmed on 19 of the 27, with over 100 additional websites infected, and more than 600,000 payment card records came from two companies alone. This ai agent retail card skimming campaign is the first one where the unit economics are the finding.

I want to walk through the tooling, the numbers that are actually confirmed, and the one part of this that a security team running its own agents can act on.

TL;DR

One operator chained three publicly available agent tools against retail and hospitality targets from July 2026 through at least mid-September.
At least 27 companies were compromised between September 10 and 15, skimmers were confirmed on 19 of them, and over 600,000 card records came from two victims.
The operator's mean cost was $25.46 over 101 completed scans, with total spend between $12,000 and $18,000 across seven weeks.
The three tools are ordinary security software, so the defensive question is whether your own use of them produces an attributable record.

The tool chain

Gambit Security names three publicly available projects, each doing a distinct job.

Strix handled vulnerability scanning. Cairn ran as the autonomous penetration testing engine. Hermes did orchestration and autonomous exploitation, coordinating the campaign and issuing tactical direction.

A naming note before anything else, because two unrelated things now share a word. The Hermes in this campaign is an agent-orchestration tool. It has nothing to do with the DeepSeek model of the same name that an attacker used directly in a campaign I covered earlier this year. Same word, different layer, different vendor, no relationship.

None of the three projects was built as malware. They are autonomous penetration testing frameworks of the kind a security team evaluates for internal use, and that is the whole problem with treating this as a malware story.

What the numbers confirm and what they do not

The Register and BleepingComputer carried the research on September 23 and 25, and the figures move slightly between accounts, so the precise version is worth stating.

The campaign ran from July 2026 through at least mid-September. The 27-company figure covers compromises between September 10 and 15, which is a five-day burst inside a seven-week operation. Skimmers were confirmed on 19 of those 27 victims, and more than 100 additional websites were infected. The 600,000-plus card figure came from two companies.

On cost, the confirmed measure is a mean of $25.46 over 101 completed scans, and total spend between $12,000 and $18,000. A per-company figure of roughly $25 circulated widely, and the underlying measurement is per scan.

Attribution came from the operator's own session material. A system persona titled "SOUL - Red Team Operator" was loaded in Chinese, and human prompts were typed in Chinese across 260 sessions. Someone was sitting at a keyboard steering this, which makes it a human operation with autonomous labour attached and not an autonomous campaign.

Twenty-five dollars changes who can do this

The exploitation technique here is web application security, and there is nothing new in it. Finding an injection point on a storefront and injecting a skimmer script has been the same work for a decade.

What changed is the labour cost. An autonomous exploitation chain against 101 targets used to need a team with time, and it now needs a credit card and a week. At $25.46 per scan, the economics stop selecting for skilled operators and start selecting for anyone with a hypothesis about which retailers are soft. Volume becomes the strategy because volume is affordable.

My view is that the security industry has spent two years arguing about whether models can write novel exploits and missed the cheaper development entirely, which is that models make unremarkable exploitation scale. Nothing in this campaign required a capability that did not exist in 2024. It required 260 sessions of patience that a human no longer has to supply.

Where the boundary sits

The exploitation itself is outside anything a policy gateway touches, and I would rather say that plainly than imply otherwise.

These agents attacked web applications belonging to retailers. Finding and abusing a vulnerability in a storefront, then injecting a skimmer into a checkout page, is application security work. No proxy between your staff and an LLM patches a retailer's website or detects a malicious script on a payment page. The victims here needed application security testing, dependency hygiene and content integrity monitoring on their own storefronts.

The in-boundary problem is your own use of the same tools

Strix, Cairn and Hermes are the tools your own red team is evaluating right now, or already running.

That creates an attribution problem that has nothing to do with criminals. An agentic pentest framework running inside your environment makes sustained, high-volume calls to commercial model APIs while it reasons about targets. If those calls leave on a shared key from a shared service account, your records name a service and a hostname. They cannot tell you which engineer started the run, which scope the run was authorized against, or which target it actually reached.

The questions a security leader will eventually have to answer about internal agentic tooling are specific. Which agent, under which person's authority, against which target, at what time. A per-request record written at the egress point answers all four, because it captures the identity behind the call rather than the credential used by the process. The identity mechanism is covered in the AI agent post-authentication gap, and the coverage requirement in AI egress control.

There is a detection benefit too, and it is modest. Sustained, unscoped, high-volume calling from a tool that should be running against a defined scope for a defined window is a visible pattern when identity and volume are recorded per request. It is a governance signal about your own environment, not a way to catch someone else's operator.

How this differs from the other 2026 agent campaigns

Four shipped pieces sit nearby, and blurring them would lose the specific lesson in each.

A nation-state multi-agent intrusion into government agencies is the Taiwan case, written up in multi-agent government intrusion and agent identity authorization. Full-autonomy ransomware with database extortion is JadePuffer. AI as a force multiplier for a human operator inside cloud infrastructure is the Sygnia case. An attacker using a deployed open model as the reasoning engine is the DeepSeek campaign.

This one owns the retail vertical, card-skimming monetisation, and the per-scan cost of a single low-resourced criminal operator. The continuing thread is in agentic AI news.

DeepInspect

DeepInspect is a stateless proxy between authenticated users or agents and any LLM endpoint. Policy evaluation runs inline on the HTTP request, and the identity resolved for the decision is the person or registered service behind the call rather than the credential the process happens to hold.

For internal agentic tooling, that distinction is the whole value. Each request writes a signed record carrying the authenticated identity, the agent that made the call, the destination model and version, the classification applied, the policy in force and the outcome. Retrieval by person, agent, destination or time range answers scope questions in seconds instead of interviews. The boundary is authenticated HTTP traffic between your people or agents and the models they call. Storefront application security, skimmer detection and payment page integrity stay with the tools built for them.

If your red team is running agentic tooling on a shared API key, the attribution gap is already there. Book a demo today.