25 dollars a target
On 22 September Gambit Security, an Israeli cybersecurity company, published a report whose title reads like a price list: "AI Agents Are Hacking Online Retailers for $25 a Company".1 Its researchers recovered a criminal's staging server and used it to reconstruct the campaign, which had been running since at least July and was still going when the report came out.
The operator used three open-source programs. Strix, a security testing tool, looked for vulnerabilities. Cairn, an engine that works on its own until it reaches its goal, exploited them until it gained access. Hermes, a general-purpose agent with a memory and skills it writes for itself, coordinated the work and decided the next moves. Across 260 sessions the person behind it all typed 1,951 instructions, almost always short and in Chinese. The agents did the rest, close relatives of the ones starting to shop on our behalf.
Between 10 and 15 September the operator launched 105 attack projects, and at least 27 companies were compromised to varying degrees. Two of them lost more than 600,000 unexpired payment cards, 79% issued in the United States. On other sites the agents installed a skimmer, a piece of code that copies card details while the customer types them. When access succeeded, it usually took less than a day, often a few hours.
The criminal kept track of the costs. In the operator's own cost review, found on the server, each completed attack cost an average of 25.46 dollars in AI models, from 3.13 to 79.31, across 101 targets. For the whole campaign Gambit estimates spending of between 12,000 and 18,000 dollars. To run the operation the operator used Anthropic's Opus 4.6, chosen, Gambit writes, after newer models refused the requests; to find and exploit flaws, Chinese models such as GLM and DeepSeek.
The report is interim, and part of the data comes from the agents' own logs, used only where independent evidence backed them up. BleepingComputer counts at least 119 sites with skimmers linked to the campaign.2
An old theft, a new price
Artificial intelligence did not invent the skimmer on the payment page. In Europe the best-known case is British Airways. In the summer of 2018 an attacker got into the airline's network with the credentials of an employee at Swissport, a supplier: remote access needed only a username and password, with no second factor. On 21 August the attacker changed a JavaScript file on the website, adding 22 lines at the bottom of a library the pages already loaded.3 For 15 days every card entered during a booking was copied to a lookalike domain, BAways.com. A third party spotted it and alerted the airline on 5 September. The data involved about 429,612 people, and in October 2020 the UK data protection regulator fined British Airways 20 million pounds.4
Eight years later, the method Gambit's agents used most is the same: append malicious code to a legitimate JavaScript file and restore the original modification date, so nobody notices the change. What has changed is who does the work. In 2018 it took a group able to study a site for weeks. In 2026 an operator types a few lines and the agents pick the route target by target: in one case, from an SQL injection all the way to decrypting stored cards, by way of the admin panel.
The companies that build the models have been documenting this for more than a year. In October 2025 OpenAI wrote that the criminals it banned were building AI into the workflows they already had, rather than building new ones around it, and that its models had not given them new offensive capabilities.5 In August 2025 Anthropic had described "vibe hacking": a single criminal who used Claude Code to hit at least 17 organisations, with ransom demands that sometimes exceeded 500,000 dollars.6 In November it reported an espionage campaign, attributed to a Chinese state-sponsored group, in which AI did 80-90% of the work against about thirty targets.7 In the September 2026 report one heading reads: "Sophisticated attacks no longer require sophisticated attackers".8
The techniques are the ones known for years; what has collapsed is the cost of chaining them together. On 19 October Reuters reported another campaign, uncovered by researcher Snorre Fagerland of NorForge through some Cairn control panels left exposed. A Chinese-speaking hacker tried to break into more than 1,200 sites and breached those of over 100 companies, including Deere, SharkNinja and Cummins, spending about 5,000 dollars on models: 50 dollars for each successful intrusion. Reuters could not establish how much data was taken.9
Italy is already a target
The cards stolen in Gambit's campaign are mostly American, but the Italian figures describe a country that is badly exposed. In its Operational Summary for August, Italy's National Cybersecurity Agency (ACN) counted 49 ransomware claims against Italian organisations, the peak of the twelve months shown in the report. They hit above all manufacturing, wholesale and retail trade and other private companies, and got in mainly through two doors: known vulnerabilities and valid credentials stolen earlier. In the same month the ACN found 9,121 systems and services exposed to risk, almost six thousand more than in July, mostly cPanel installations, the software many hosting companies give customers to manage their sites.10
According to Bitdefender, in August Italy rose to second place in the world for victims claimed by ransomware groups.11 The Clusit 2026 report counted 507 serious incidents in Italy in 2025, 42% more than the year before and 9.6% of those recorded worldwide. At the launch Gabriele Faggioli, chair of Clusit's scientific committee, pointed out that Italy spends 0.13-0.14% of GDP on cybersecurity, while comparable G7 countries are around 0.3%.12
Online commerce is the easiest target for anyone after cards. In 2024, according to the joint report of the European Banking Authority and the ECB, remote card payments accounted for 28% of the value of card payments but 83% of the value of card fraud. And more than half the value of remote fraud came from stolen card details.13
Where card fraud concentrates in Europe
Who is required to protect themselves
In Italy the EU's NIS2 directive became Legislative Decree 138/2024, in force since 16 October 2024. It broadly covers medium and large companies in the sectors the decree lists. In 2025, after more than 30,000 registrations and the ACN's checks, there were more than 21,800 NIS entities.14 For those notified of their inclusion in spring 2025, the basic security measures must be in place within 18 months, which means these very weeks. Significant incidents must be reported to CSIRT Italia with an early warning within 24 hours and a full notification within the following 72 hours.15
An online shop with five staff will usually fall outside NIS2, but that does not leave it without rules. If it suffers a personal data breach it must report it to the Italian data protection authority within 72 hours, as the GDPR requires.16 And if it takes cards it must comply with the PCI DSS standard, which banks and card schemes require of merchants. Since 31 March 2025 two requirements of version 4.0 written against skimmers have been mandatory. Requirement 6.4.3 asks whoever runs the payment page to authorise every script running on it, assure its integrity and keep an inventory with a justification for each. Requirement 11.6.1 asks for a mechanism that raises an alert when the page or its scripts change without authorisation. Merchants who use a payment form hosted by their provider fill in a simpler questionnaire, SAQ A, from which the two requirements were removed; in exchange they must confirm that their site is not susceptible to attacks from scripts.17
What I think
For years many small retailers reasoned along the lines of "who would bother attacking me?". There was a logic to it: a tailored attack took days of skilled work, and a small shop was not worth the expense. The Gambit case removes that accidental protection. The operator picked targets from a website traffic ranking, filtered to the shopping category, and deliberately skipped shops built on the big e-commerce platforms, believing custom code would have more flaws. At 25 dollars a try, going after the small shop as well pays off.
In Italy 87,000 businesses run an active online shop, 4.4% fewer than a year earlier, and more than 90% of them are micro or small enterprises.18 Among companies with at least ten employees, 15.3% sell online directly to consumers.19 The Cyber Index PMI by Confindustria and Generali gives Italian SMEs 55 points out of 100 for cyber awareness, below the pass mark of 60, and almost one SME in four has suffered a breach in the last three years.20
I think the security of an online shop should be treated like the fee on card payments: a fixed part of the cost of selling, decided when the shop opens and not after the first incident. For a small shop the safest choice is often the dullest one: a platform maintained by someone else and a payment page hosted by the provider. When I wrote about who checks the code AI writes, the imbalance was between those who produce and those who verify; here it is between those who attack and those who defend. And I would not count too much on the filters of model providers: in the Gambit case the newest models said no, and the operator switched to an older one and to Chinese models.
The best protections can go unnoticed: when they work, they prevent the worst from happening.
Tenth law of innovation, from Un perché alla volta (translated)
That is why it is hard to convince anyone to pay for them. On the day they work nothing happens, and nobody notices.
Four things to do now
For a small business selling online, this is where I would start. None of these measures needs a security department.
- PaymentKeep the card form off your siteUse the payment page or field hosted by the provider, in an iframe or through a redirect, so card numbers never pass through your own code.
- ScriptsAn inventory and an alarm on the payment pageKnow which scripts run in the checkout, block the rest with a Content Security Policy and get an alert when a file changes. The British Airways skimmer stayed live for 15 days.
- AccessUpdates and a second factorUpdate the CMS, plugins and hosting panel within days of fixes coming out, and require a second factor for anyone logging in as an administrator, suppliers included.
- BackupsCopies the attack cannot reachCopies kept apart from the server, tested with a real restore. At a bicycle retailer the agents' clean-up after the theft deleted 180 tables, including the administrators' own copies.
The first step costs less than the 25 dollars of the attack: ask whoever runs your site which scripts run on the payment page and who gets the alert if one of them changes. If the answer does not come within a day, that is where to start.