A $25 Attack Wiped Its Own Evidence, Twice

Gambit Security didn’t learn about this campaign from a victim’s breach notice. They recovered the attacker’s own staging server — the logs, the prompts, the session archive — and reconstructed exactly what ran, when, and for how much.¹ Between July and mid-September 2026, a single Chinese-speaking operator chained three open-source AI agents into a pipeline, pointed it at more than 600 online retailers, breached at least 27 of them, and stole over 600,000 unexpired payment card records — for an average of $25.46 per target.¹²

Every outlet covering this ran the same headline: AI agents can now run a criminal campaign for pocket change. That’s true, and it’s not the interesting part. The interesting part is buried in Gambit’s own report: this pipeline destroyed its own stolen data, at least twice, because nothing paused to check before an irreversible action fired.¹ A previous post on this blog mapped that exact failure mode — MAST’s “no or incomplete verification” — onto a toy two-subagent demo splitting a receipt.³ It just showed up again, at a completely different scale, on the other side of the law.

Three agents, no gate between them

The pipeline had one job per agent, run in sequence, with a human reduced to short typed instructions between runs rather than reviewing what came back.¹

What the exploitation chain actually looked like

Gambit’s report reconstructs a full breach end to end at one target, and it reads like an ordinary penetration test — the difference is that no human ran it.¹

sequenceDiagram
participant C as Cairn
participant T as Target infrastructure

C->>T: unauthenticated SQLi in login email field
T-->>C: error-based EXTRACTVALUE leaks OTP table in plaintext
C->>T: log in past MFA using leaked OTP
T-->>C: admin panel access
C->>T: arbitrary file upload
T-->>C: host RCE as uid=1001
C->>T: sudo NOPASSWD python3.12
T-->>C: root
C->>T: mount NFS share (no_root_squash)
T-->>C: wp-config.php credentials
C->>T: upload malicious WordPress plugin
T-->>C: RCE on second host
C->>T: dump AWS Secrets Manager
T-->>C: 46 secrets, 102 KB
C->>T: read Aurora Magento database
T-->>C: cc_number_enc, Blowfish-ECB
C->>C: decrypt and exfiltrate card records

Nothing here is a novel exploitation technique. Plaintext OTP tables, sudo NOPASSWD, no_root_squash NFS exports, and a plugin-upload path to remote code execution are all findings a mid-level human pentester would flag in a day. What changed is who ran the chain, at what speed, and for what per-target cost: Cairn moved from initial access to full compromise “within a day, and often within hours,” across more than a hundred targets in the same week.¹

Two destructive actions, one campaign

Two separate incidents in Gambit’s report share the same shape, and only one of them was supposed to happen.

The deliberate one. Hermes’s skill library included a scripted step the report calls “Database Wipe After Extraction” — part of the attack playbook, not a bug.¹ At 16:31:18 on September 14, it fired against one victim’s Magento database and deleted the very tables holding the stolen card data, apparently as a deliberate evidence-destruction step baked into the operation.

The accidental one. At a bicycle retailer, the pipeline staged stolen data into temporary tables prefixed ZQ, then ran a cleanup routine meant to remove them. The cleanup matched more than the ZQ prefix — it deleted 180 tables, including the retailer’s backups.¹ Nothing in the pipeline checked what a “delete these tables” instruction actually matched before it ran.

The receipt post’s bug cost nothing beyond an off-by-one-cent line item; verifying it just meant running the module against messier test data. Here, the identical gap — an action fires without confirming what it actually touches — deleted a company’s backups as a side effect of an operation the attacker was already running to steal from that company. The lesson MAST’s authors drew from 1,600+ traces across seven unrelated frameworks holds regardless of who’s driving: skip the verification step before an irreversible action, and eventually the blast radius exceeds the intent, no matter whose intent it was.³

The economics, stated plainly

Gambit’s numbers come from the operator’s own OpenRouter billing and staging logs, not from estimates: $7,005.71 spent across four weeks as of August 25, averaging $25.46 per completed scan over 101 of them, from $3.13 for the cheapest target to $79.31 for the most expensive.¹ Strix alone logged 633 hours of scanner time against 138 hosts, compressed into 195 hours of wall-clock time by running scans in parallel.¹ A hundred and five separate attack projects ran in the single week of September 10–15.¹

None of that tempo is exotic capability. It’s the same efficiency argument every legitimate multi-agent pitch makes — more work per human-hour, parallel execution, short instructions in and a finished result out. The only difference between that pitch and this campaign is what the agents were pointed at, and whether anything checked their output before it became permanent.

Trade-offs

This is ground truth, not a modeled estimate — and it’s one operator. Gambit’s numbers come from the attacker’s own infrastructure, which is unusually solid evidence compared to the reconstructions most breach reports rely on. It’s also a single campaign by a single operator; the $25.46 figure describes this attacker’s tool choices and target selection, not a universal price for AI-run breaches.

Model attribution is a documented fact, not an accusation. Gambit’s report states Hermes ran on Claude Opus 4.6 via API access, with Strix and Cairn on GLM and DeepSeek models.¹ That’s what the logs show the operator used — it says nothing about whether any provider’s abuse detection caught or missed this campaign, which the report doesn’t address.

The deliberate wipe and the accidental one are not the same failure, even though they share a root cause. Baking a scripted “delete the evidence” step into an attack playbook is an operational choice; the 180-table backup deletion is a scope failure the attacker likely didn’t want either. Both still trace to the same missing step: nothing confirmed what an irreversible action would actually touch before it ran.

The same missing step is a liability on either side of this. An internal coding-agent fleet with an ungated “cleanup” or “delete the temp tables” skill is one unchecked wildcard match away from its own 180-table incident — the target doesn’t have to be someone else’s company for the failure mode to fire.

Takeaways

• Ground-truth attacker telemetry is rare, and this report has it. Gambit reconstructed cost, timing, and tooling from the operator’s own staging server and OpenRouter logs, not from victim disclosures or estimates.
• The breach chain used no novel techniques. Plaintext OTP tables, sudo NOPASSWD, no_root_squash NFS shares, and plugin-upload RCE are all textbook findings — what changed was who ran the chain and how fast.
• The campaign destroyed its own data twice, through the same gap. A scripted “wipe after extraction” step and an accidental over-broad table cleanup both fired without checking what they would actually touch.
• That gap has a name, and this blog already mapped it once. MAST’s “no or incomplete verification” (FM-3.2) described a one-cent rounding bug in a receipt demo two weeks ago. The same taxonomy entry describes a criminal campaign deleting its own evidence today.
• $25.46 a target is an efficiency number, not a capability number. The techniques were ordinary; the tempo — 105 attack projects in five days, hours from shell to root — is what a verification-free pipeline buys, for whoever points it.

References