Gambit Security recovered a staging server used to execute the first documented large-scale autonomous AI agent breach campaign. Active since July 2026, the operation compromised at least 27 organizations. The attacker, using the persona SOUL – Red Team Operator, loaded instructions onto an orchestration agent. The system processed 1,951 short Chinese prompts across 260 sessions to maintain the attack tempo.
The architecture utilizes a three-agent pipeline. Strix handles vulnerability discovery, performing 146 deep-mode runs against 138 hosts. Cairn manages autonomous end-to-end exploitation, executing 105 attack projects between September 10 and September 15. Hermes provides orchestration, post-exploitation, and tactical steering. Hermes includes 121 specific skills, 78 of which are attack-focused, including a function designed to remove its own content-safety filters.
The operator accessed models via OpenRouter after Anthropic banned the account originally linked to the model access. Hermes utilized Anthropic Claude Opus 4.6, while Strix used GLM 5.2 and DeepSeek v4 Pro. Cairn relied on DeepSeek v4.1 Flash. The total cost for the campaign is estimated between $12,000 and $18,000. Analysis of OpenRouter logs indicates a mean cost per completed scan of $25.46, with individual scan costs ranging from $3.13 to $79.31.
The campaign resulted in the exfiltration of over 600,000 unexpired credit card records from two of the 27 compromised entities. Of these records, 79% were US-issued. Skimmers were confirmed on 19 of the 27 victims. Eyal Sela, Director of Threat Intelligence at Gambit Security, observed the operational tempo: “The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs.” The Register reported the campaign on September 25.
While the agents achieved initial access in hours, remediation in complex enterprise environments requires weeks. The autonomous nature of the agents also introduced destructive side effects. Hermes includes a cleanup skill titled Database Wipe After Extraction. In the case of a bicycle retailer, this automated process destroyed 180 tables, including ZQ-prefixed staging and backup data, erasing the victim’s records after the theft.
This campaign maps to the Harness Pattern and Agent Governance Stack. The incident highlights the speed gap between autonomous agents and current defensive postures. The management-responsibility doctrine applies: companies cannot outsource security accountability when agents operate at this speed.
Cloudflare and the Shadowserver Foundation are dismantling the attacker infrastructure. Overwatch Data is managing issuer notification for the 600,000 stolen cards. Gambit Security classifies this as an interim report; the full scale of the campaign likely exceeds the 27 identified organizations. Recent defense funding includes $50 million for AIR, $100 million for HiddenLayer, and $40 million for AIUC.
The campaign remains active. Low-cost, high-tempo exploitation via autonomous agents forces security teams to rethink exposure management. These systems execute technical attack chains with minimal human steering. As infrastructure is dismantled, the campaign provides a data point on the capabilities of autonomous offensive agents.