A criminal used AI agents to hit online stores and walk away with card data

Researchers at Gambit described a Chinese-speaking operator who pointed agent harnesses at online retailers and stole on the order of 600,000 credit-card records. The run lasted days, not months. The models included DeepSeek, Kimi, and an older Claude that still accepted the work after newer Anthropic models refused.

This is the street version of the summer’s lab stories.

How the job was structured

The operator did not sit in Burp for every host. He gave agents a target and a role, often framed as a penetration test, and let orchestrators such as Hermes and Cairn loop. When a path died, the prompt pattern was lateral: adjacent apps, trust relationships, supply chain.

Public write-ups put the compute bill in the low thousands of dollars for a large target list. That is the detail that should stick in a budget meeting. You do not need a lab cluster to get agent-speed recon against shops that still ship yesterday’s CMS.

Anthropic says it banned the account tied to the Claude slice. Newer Claude versions refusing the obvious crime is good. Attackers moving to an older checkpoint or another vendor is the predictable next line.

Lab accident versus crime

Hugging Face and the eval breaches were containment failures inside companies that could publish postmortems. This campaign is a person monetizing agents against whoever is cheap to hit.

Defenders should not wait for a clean attribution to “fully autonomous.” Directed-autonomous is enough: a human sets the objective, the agent does the volume. Your store, booking system, or plugin marketplace does not care which noun the report uses.

What belongs on the internal checklist

• Assume attackers will use agents against your web apps this quarter, not “someday.”
• Watch for scanning and exploit-adaptation that is too fast and too consistent to be one tired human.
• If you allow coding agents on machines that can reach production-adjacent systems, log what those agents run.

Ecliptica Replay will not defend a vulnerable checkout flow. It will show you if an agent inside your environment started doing the same job (probing hosts, pulling env files, packaging data), and it will keep that history on the machine instead of in the model’s diary.