A Chinese-speaking cybercriminal spent roughly $12,000 to $18,000 in cloud and API fees to breach a Fortune 500 hospitality company, a major US airline, and more than two dozen other organizations, according to a Gambit Security investigation reported by The Register on September 25, 2026, a finding Yahoo News independently corroborated that same month, confirming that three open-source AI tools had automated the breach of more than 27 organizations. The operator did not write custom exploit code or hire a crew. Instead, the attacker leaned on three open source agentic AI tools, stringing them together into an automated pipeline that scanned, broke in, and exfiltrated data with almost no human effort per target.
Tech Insider previously covered the discovery of this campaign when it first surfaced (AI Agents Breach 27 Firms, Steal 600K Cards for $25). This follow-up digs into the numbers that piece did not have room for: what the campaign actually cost to run, which sectors got hit hardest, and what defenders can take away from an operation cheap enough that a single freelancer could fund it out of pocket.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What The Register’s Report Adds to the Story
According to Gambit Security’s findings, researchers gained visibility into the attacker’s own staging infrastructure, effectively watching the campaign unfold from the inside rather than piecing it together after the fact. That vantage point let them reconstruct not just which organizations were hit, but how the operator budgeted, scheduled, and prioritized targets. The Register describes the attacker as financially motivated and Chinese-speaking, running a persona called “SOUL – Red Team Operator,” though no legal identity or established threat-group name has been confirmed publicly.
Per the findings, at least 27 companies were compromised to varying degrees. The most sensitive intrusions hit a Fortune 500 hospitality company with reported annual revenue above $10 billion, a major US airline, a large private US industrial-supplies distributor, and a US online fashion retailer with revenue above $1 billion. None of the four were named outright, only described by sector and scale, which is standard practice when a security vendor obtains attacker-side data rather than victim confirmation.
Meet the Three Open Source Agents: Strix, Cairn, and Hermes
The campaign’s toolkit split cleanly into three functions, each handled by a separate open source agent. Strix handled vulnerability discovery and scanning, crawling target infrastructure for exposed services and misconfigurations. Cairn took over exploitation, attempting to turn discovered flaws into shells or administrative access. Hermes sat above both, orchestrating jobs, sequencing tasks, and handling persistence and post-exploitation work once a foothold was established.
None of the three tools were built for crime. All three originated as legitimate open source security research projects, the kind of software a red team or bug bounty hunter might run against systems they have permission to test. The attacker’s contribution was not code, it was orchestration: chaining publicly available agents into a repeatable pipeline and running it against hundreds of targets without needing to hire operators for each stage.
Worth noting for anyone searching indicators of compromise: this Cairn is unrelated to the defensive tool of the same name that Cisco Talos ships to track AI-generated malware, which Tech Insider covered separately (Talos Ships CAIRN Tool to Track 4-Model AI Malware). The naming overlap is coincidental but has already caused confusion among security teams cross-referencing threat intel feeds.
Inside the Attack Economics: $25 a Scan, $12,000-$18,000 for the Whole Campaign
The number that has security researchers talking is not the victim count, it is the price tag. Gambit Security’s September 2026 analysis puts the average cost of a completed scan at approximately $25.46 across 101 tracked scans, with individual runs ranging between $3.13 and $79.31 depending on target size and how many follow-up actions the agents triggered. Across the full campaign, the operator’s total spend came out to roughly $12,000 to $18,000, covering compute, API calls to the underlying models, and infrastructure for staging stolen data.
For context, that $12,000 to $18,000 bought access into a company with more than $10 billion in annual revenue. A single incident response engagement at a company that size typically costs organizations far more than that just to clean up afterward, based on industry breach-cost research such as the Verizon Data Breach Investigations Report. The asymmetry between attacker cost and victim cost is exactly what makes agentic tooling attractive to financially motivated crews: the economics scale in the attacker’s favor at every step.
Five Days, 105 Attack Projects
Gambit Security’s timeline shows the operator launched 105 separate attack projects between September 10 and September 15, 2026, a five-day burst that accounts for the bulk of the confirmed compromises. The broader campaign, including reconnaissance and lower-intensity probing, reportedly ran from July through September 22, 2026. Over that stretch, the campaign’s reach extended to at least 119 sites, though only a subset resulted in confirmed data theft.
The headline damage figure is payment-card data: at least 600,000 unexpired payment-card records were stolen from two of the compromised companies, a figure the Cloud Security Alliance independently corroborated in its own September 2026 review of the exfiltration data. Investigators also found that the attacker installed payment-card skimmer scripts on at least 119 websites, a technique more associated with manual Magecart-style crews than automated agent pipelines. That detail suggests the operator blended AI-driven reconnaissance with older, hands-on monetization methods once inside a network.
Campaign by the Numbers
| Metric | Reported Figure |
|---|---|
| Companies compromised | At least 27 |
| Sites reached during broader campaign | At least 119 |
| Attack projects launched (Sept 10-15, 2026) | 105 |
| Campaign duration | July – September 22, 2026 |
| Payment-card records stolen | 600,000+ (from two companies) |
| Websites with skimmer scripts installed | At least 119 |
| Average cost per completed scan | ~$25.46 |
| Cost range per scan | $3.13 – $79.31 |
| Estimated total campaign cost | $12,000-$18,000 |
Source: Gambit Security investigation, as reported by The Register, September 25, 2026.
Who Got Hit: Hospitality, Aviation, Distribution, and Retail
The four named-by-sector victims give a sense of how indiscriminate the targeting was. A Fortune 500 hospitality company generating more than $10 billion a year sits in a very different risk category than a mid-size fashion retailer, yet both appear in the same attacker’s project list, and a separate September 2026 Cloud Security Alliance analysis found AI agents had breached more than 100 retailers industry-wide using comparable automated tactics. That is the point of agentic tooling: once the pipeline exists, the marginal cost of adding another target is close to zero, so operators stop being selective about company size or industry and instead cast as wide a net as their budget allows.
A major US airline appearing on that list is notable given how much scrutiny aviation has faced this year over legacy systems and third-party vendor risk. Airlines route enormous amounts of customer payment data through loyalty programs, ancillary purchases, and partner integrations, all of which widen the attack surface an automated scanner like Strix can probe without needing airline-specific expertise.
Why AI Agents Change Cybercrime’s Math
Traditional breach campaigns require a team: someone to find vulnerabilities, someone to write or adapt exploits, someone to maintain access, and someone to monetize whatever gets stolen. Each role adds cost, coordination overhead, and a point where an operation can stall or get sloppy. What this campaign demonstrates is that a single operator with a laptop, a handful of open source repos, and a few thousand dollars in API credits can now compress that entire pipeline into an automated loop.
That shift mirrors patterns Tech Insider has tracked across several recent disclosures. Palo Alto Networks’ Unit 42 previously documented an AI agent chain breaching a single organization in roughly 10 hours using more than 50 distinct tactics, techniques, and procedures (Unit 42: AI Agents Breach Firm in 10 Hours, 50+ TTPs). Separately, researchers have documented CLOSEDQUORUM, Windows malware that lets four different AI models vote on its next move during an infection (CLOSEDQUORUM Malware Lets 4 AI Models Vote on Next Move). Each case points the same direction: attackers are outsourcing judgment calls to models, not just automating repetitive scanning.
Market Impact: Security Spending and Insurance Pressure
Enterprise security budgets have already been shifting toward detection tools built to spot AI-driven attack patterns rather than signature-based malware. Vendors offering agentic-threat detection, behavioral analytics, and API rate-anomaly monitoring stand to see renewed demand as security leaders digest a campaign that cost the attacker less than a single junior analyst’s monthly salary yet touched 27-plus enterprises. Cyber insurers are also watching closely: a breach that originates from commodity open source tooling rather than a nation-state-grade exploit complicates how underwriters price risk, since the barrier to entry for would-be attackers has effectively collapsed.
Frameworks like MITRE ATT&CK and guidance from OWASP are being updated across the industry to account for agent-orchestrated attack chains, where a single automated pipeline can move through reconnaissance, initial access, and exfiltration stages that used to require distinct toolsets and operators.
Historical Context: From Manual Pentesting to Agentic Exploitation
Automated vulnerability scanning is not new; tools like Nessus and Nmap have existed for decades and were built for defenders. What has changed in 2026 is the addition of a reasoning layer on top of scanning: agents that can interpret scan output, decide which findings are worth pursuing, generate exploitation attempts, and adapt when the first attempt fails, all without a human reviewing each step. Earlier this year, GPT-6 Astra’s jump to a 100% score on an exploit benchmark pushed one AI vendor to reclassify the model’s risk level as critical (GPT-6 Astra Hits 100% ExploitBench, Now ‘Critical’), a milestone that foreshadowed exactly the kind of automated exploitation chain now showing up in real breach investigations.
The Strix-Cairn-Hermes campaign is best understood as the criminal mirror image of that same capability curve. The same agentic reasoning that lets a security researcher automate a penetration test lets a financially motivated operator automate a crime spree, and the tooling gap between the two use cases is effectively zero since both draw from the same open source ecosystem.
Comparing 2026’s AI-Driven Attack Disclosures
| Campaign / Tool | Disclosed By | Core Method | Reported Scale |
|---|---|---|---|
| Strix / Cairn / Hermes | Gambit Security, via The Register | Chained open source agents for scan, exploit, orchestrate | 27+ companies, 600K+ card records |
| Unit 42 disclosed intrusion | Palo Alto Networks Unit 42 | Agent chain executing 50+ TTPs autonomously | Single org breached in ~10 hours |
| CLOSEDQUORUM | Independent malware researchers | Multi-model voting malware on Windows | 4 AI models used for decision-making |
| BragJack | Browser security researchers | Hijacking of AI browser agents | Affected agents across 5 browsers |
Compiled from public disclosures reported through September 2026.
How Gambit Security Uncovered the Operation
What separates this disclosure from a typical breach notification is the vantage point. Gambit Security did not learn about the campaign from a victim report or a dark web listing, it reportedly gained visibility into the attacker’s own staging infrastructure, the servers and logs the operator used to run and track the agent pipeline. That access is what allowed researchers to reconstruct exact costs per scan, project counts, and the day-by-day cadence of attacks rather than relying on victim disclosures, which are typically incomplete and delayed by legal review.
This kind of attacker-side visibility is rare and tends to produce far more granular data than post-breach forensics on the victim side. It is also why this disclosure reads more like an operational audit of a criminal business than a traditional incident report.
Illustrative Detection Pattern for Defenders
Security teams reviewing logs for signs of agent-orchestrated reconnaissance are generally watching for bursts of automated, sequential probing that a human operator would not typically produce by hand. A simplified example of the kind of log pattern defenders look for resembles this:
alert http any any -> $HOME_NET any (
msg:"Possible agent-orchestrated scan burst";
flow:established,to_server;
threshold: type threshold, track by_src, count 50, seconds 60;
classtype:attempted-recon;
sid:9000123; rev:1;
)This is illustrative rather than a verbatim rule from any vendor’s product, but it reflects the general approach: flag abnormally high-volume, high-velocity scanning bursts against a single target within a short window, since that pattern is a hallmark of an automated agent pipeline rather than manual reconnaissance.
What This Means for Enterprise Security Teams
The practical takeaway for security leaders is that the volume of automated probing hitting internet-facing infrastructure is likely to keep climbing, because the cost of running that probing has collapsed. A $25 average cost per scan means an operator can afford to attempt hundreds of targets and only need a small fraction to pay off. That changes the calculus for which companies are “too small to be a target.” Every internet-facing asset is now cheap enough to probe, regardless of company size.
Enterprises are facing this pressure alongside a record patch load; Microsoft’s own September 2026 update addressed 966 vulnerabilities in a single cycle (Microsoft Patches Record 966 Bugs, 20 Wormable), underscoring how much unpatched surface area automated agents have to work with at any given moment. Guidance from national agencies such as the UK’s National Cyber Security Centre increasingly recommends treating exposed services as if they will be probed by automated tooling within hours of going live, not weeks.
Predictions: Where This Trend Goes Next
Based on the trajectory of disclosures through 2026, several trends look likely to continue over the next 12 months.
- More low-budget, high-volume campaigns will surface as open source agentic tools mature and require less technical skill to chain together.
- Security vendors will increasingly market “agent detection” as a distinct product category, separate from traditional endpoint and network detection.
- Regulators and cyber insurers will start asking companies to disclose exposure to automated scanning volumes, not just confirmed breaches, when assessing risk.
- Expect more attacker-side visibility disclosures like Gambit Security’s, as researchers increasingly find ways into staging infrastructure rather than waiting on victim reports.
- Payment-card skimming will likely persist as a monetization method even as reconnaissance and initial access become fully automated, since card data remains one of the fastest paths to cash.
Frequently Asked Questions
What are Strix, Cairn, and Hermes?
They are three separate open source AI agent tools that a financially motivated operator chained together: Strix for vulnerability scanning, Cairn for exploitation, and Hermes for orchestration and post-exploitation activity, according to Gambit Security’s findings reported by The Register.
How many organizations were affected?
At least 27 companies were compromised to varying degrees, with the attacker’s broader campaign reaching at least 119 sites between July and September 22, 2026.
Were the victim companies named?
No. The disclosure described victims by sector and scale only: a Fortune 500 hospitality company, a major US airline, a large private US industrial-supplies distributor, and a US online fashion retailer. No corporate names have been publicly confirmed.
How much did the campaign cost the attacker?
Gambit Security estimated the total campaign cost at approximately $12,000 to $18,000, with individual scans averaging about $25.46 and ranging from $3.13 to $79.31.
How much data was stolen?
At least 600,000 unexpired payment-card records were stolen from two of the compromised companies, and skimmer scripts were found installed on at least 119 websites.
Is this the same campaign reported earlier as the Hermes-Strix-Cairn breach?
Yes. This is the same underlying Gambit Security investigation, with The Register’s latest report adding named victim sectors and a detailed cost breakdown not included in earlier coverage.
Is the “Cairn” used in this attack the same as Cisco Talos’s CAIRN tool?
No. They share a name but serve opposite purposes. The attacker’s Cairn is an exploitation agent, while Cisco Talos’s CAIRN is a defensive tool built to track AI-generated malware.
Has the threat actor been identified?
No formal identity or named group has been confirmed. Reports describe the operator only as Chinese-speaking and financially motivated, operating under the persona “SOUL – Red Team Operator.”
