x.com/joshua_saxe/status/2102979329911091245
1 correction found
used agents to compromise ~100 businesses and steal about 600,000 credit cards
The cited Gambit report does not say about 100 businesses were compromised. It says 105 attack projects were launched, at least 27 companies were compromised, and the 600,000+ card records came from just two victim companies.
Full reasoning
Gambit Security's own writeup distinguishes targets / attack projects from confirmed compromised companies. It says that 105 attack projects were launched between September 10 and 15, 2026, but only "at least 27 companies were compromised to varying degrees" during that span. It separately says the attackers exfiltrated more than 600,000 credit-card records from two victim companies.
So the post's wording overstates the confirmed impact by collapsing several different numbers into one claim:
- 105 = attack projects launched, not businesses confirmed compromised.
- 27 = companies Gambit says were compromised to varying degrees in that window.
- 600,000+ cards = cards taken from two companies, not from ~100 compromised businesses.
- Gambit also mentions 100+ additional infected websites associated with skimmers, which is again different from "~100 businesses compromised."
In short, the campaign appears real and serious, but the evidence published by Gambit does not support the specific claim that agents "compromise ~100 businesses and steal about 600,000 credit cards."
2 sources
- Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign
Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees... The impact we can account for includes at least 600,000 unexpired credit card details from two companies.
- AI-Powered Campaign Targets Hundreds of Online Retailers - SecurityWeek
"Between 10 and 15 September alone, 105 attack projects were launched, and at least 27 companies were compromised to varying degrees," Gambit says. The hackers stole information from over 600,000 unexpired credit cards from two of the compromised companies.