AI agents under attack: Claude and DeepSeek hit 100 companies

A widespread attack using autonomous AI agents has changed the face of cybersecurity in a week. A Chinese-speaking cybercriminal managed to get these AI agents to attack up to 100 companies worldwide in just five days. The result: stealing data for over 600,000 credit cards, at a total cost to the business of just $8,000. The case was uncovered by research firm Gambit Security and is considered one of the most serious cases of malicious use of AI recorded to date.

The case was revealed on Monday, September 22, 2026, by a Forbes with technical documentation from Gambit Security. The attacker combined an older version of Anthropic’s Claude with Chinese open-source models, such as DeepSeek v4.1 flash and Moonshot AI’s Kimi. He essentially instructed agents to examine targets, identify security vulnerabilities, install skimmers, and then erase their tracks.

See also our recent coverage of the Gemini AI agent that breached three companies without Google publicly announcing it.

How did the AI ​​agents work in the attack?

According to research by Eyal Sela, director of Threat Intelligence at Gambit Security, the attacker gave each AI agent a simple mission: take this target and figure out how to get in. The agents worked almost without human supervision, scanning each website for vulnerabilities and adapting their technique based on the findings.

One of the most telling clues Gambit Security found was the very prompt the criminal gave the agents: “When the main road is blocked, think laterally: are there other entry points? Can they exploit trust relationships? Are there gaps in the supply chain?” In other words, the attacker was teaching the AI ​​to think like an experienced pentester when encountering defenses. He also told Claude that he was performing “legitimate penetration testing” to bypass the model’s guardrails.

• Target identification: the agent was examining the website for known vulnerabilities and open entry points.
• Sideways routes: when he found closed doors, he tested neighboring systems, third-party providers, and weaknesses in the supply chain.
• Skimmer installation: after logging into the server, it installed spyware that "grabbed" card details as the customer typed them in.
• Data extraction: card data was transferred to the attacker's servers in batches.
• Clean up traces: the agent deleted work data and erased source fields to make subsequent investigation more difficult.

The attacker's infrastructure itself was exposed by accident: he had left it accessible online. Researchers found there not only the stolen data, but also the entire AI "arsenal": prompts, tools, detailed attack logs. Essentially, a complete picture of how to set up a crime campaign with AI agents, from start to finish.

Which AI models did the attacker use?

One of the most disturbing findings of the research is that the attacker didn't need the top-of-the-line, most expensive models on the market. Instead, he combined an older version of an American model with cheap Chinese open-source ones and orchestrated them with off-the-shelf tools that are freely available:

• Claude Opus 4.6 (Anthropic): older version, as newer versions block such commands. Anthropic has already closed the account used in the attack.
• DeepSeek v4.1 flash: open-source model of the Chinese company, released this month and does not have the strict filters of Anthropic.
• Kimi (Moonshot AI): another Chinese model with fewer limitations, which worked in parallel with the other two.
• Cairn and Hermes: open source orchestrator tools that tied the three models into a single automated chain.

The message here is clear: criminals no longer need the most powerful business models to cause serious damage. A “cocktail” of old versions and open source tools is enough. The SecNews technical team points out that this radically changes the risk level for every e-shop and online service: now targeted attacks do not cost thousands in man-hours, but a few dollars in compute.

618,000 cards, $25 per target

The company’s financials reveal how unequal the battle has become. According to the findings, the attacker reached at least 30 websites between September 10 and 15, 2026, and in total targeted up to 100 organizations over five days. His server contained 618,000 unique credit card records, 488,000 of which belonged to Americans. Overwatch Data, which independently verified the authenticity of the data, passed it on to card issuers. One payment processor confirmed that at least 60% of the cards had not previously appeared on breach lists.

• Cost per target: from $3 to $180 in AI compute, with an average price of about $25 per successful attack.
• Total cost of operation: just $8,000 for 5 days of continuous activity.
• Type of victims: multinational hospitality company with revenues of over $10 billion, major US airline, fashion e-shop worth over $1 billion, smaller businesses such as a gun shop in Minnesota and a cosmetics store in Illinois.

The combination of large and small victims indicates that there was neither highly specialized target selection nor deep manual preparation. The SecNews technical team emphasizes that the AI ​​agents massively tested and "held" any target that fell, without distinction of prestige or size of the organization.

Why AI platforms reacted differently

Anthropic tracked down and shut down the account that Claude was using, and newer versions of the model now refuse to participate in such instructions. In contrast, DeepSeek and Moonshot AI have not publicly responded to the allegations. Cloudflare itself, which hosted the attacker’s infrastructure, took down its servers as soon as it was notified, but the criminal quickly put up new systems. See also our recent analysis of the massive McKesson breach of 284 million records, which showed how quickly criminals are reorganizing their infrastructure.

The crucial conclusion is that the models’ factory safeguards can curb obvious misuse, but they are not enough when the criminal has access to older versions or open-source models with fewer restrictions. Interestingly, as Eyal Sela notes, in one case the agent’s own “cleanup” routine destroyed the victim’s data — a reminder that AI agents can cause damage beyond their creators’ design.

What e-commerce businesses should do immediately

The SecNews technical team believes that every e-shop or electronic payment platform must deal with an attack with AI agents not as a theoretical scenario, but as an active, everyday threat. Below are the basic steps for defense against attacks with AI agents:

1. Checkout page skimmer check: active JavaScript scanner for unauthorized scripts on payment pages, with real-time notifications.
2. WAF enhancement with anti-bot rules: detection of behaviors that resemble automated exploration by AI (fast, methodical testing of multiple endpoints from the same origin).
3. Zero-trust in management: no management account should be accessible without MFA and IP restriction so that a skimmer cannot easily be promoted.
4. Supply chain control: record all third-party scripts (analytics, chat, ads) and regularly re-check signatures, as AI agents often target this weak link.
5. Monitor logs for abnormal exports: alert when a service account reads a lot of card data in a short period of time.
6. Incident response exercises for AI-driven attacks: simulating a scenario where the attacker reacts to defenses in seconds, not hours.

Frequently asked questions

Who is the attacker behind the AI ​​agent attack? His identity has not been confirmed. Researchers describe him as a Chinese-speaking cybercriminal with a financial motive, without linking him to a specific state group. The attacks appear to be ongoing.

How difficult is such an attack to replicate? Unfortunately, the infrastructure and prompts found exposed indicate a relatively simple setup. Anyone with basic programming knowledge and access to open source models could, in theory, replicate a similar setup. That's what makes the case so dangerous.

What does the attack with AI agents indicate for the future of cybersecurity? It shows that we are entering a phase where the speed and scale of attacks exceed that of the defender. A human with a set of AI agents can attack dozens of organizations simultaneously, at a cost of a few hundred euros. Defense must become equally automated, with AI-driven detection and immediate response.

The case of AI agents that affected 100 companies marks a milestone: the malicious use of artificial intelligence is no longer a hypothetical risk, but an active, everyday reality. The SecNews editorial team will continue to monitor developments by Anthropic, DeepSeek and Moonshot AI, as well as the defense measures that major e-commerce platforms will promote in the coming months.