AI campaign steals 600,000 payment cards

Gambit Security reports an AI-assisted campaign launched 105 attack projects between September 10 and 15 and compromised at least 27 organizations, with more than 600,000 unexpired payment-card records reportedly stolen from two companies. Gambit’s incident report says the reconstruction draws on recovered infrastructure and logs, while warning that deleted records and attacker-generated claims leave the full scope uncertain; SecurityWeek’s account reports the campaign targeted online retailers. Operators should keep payment systems outside unattended agent permissions and measure fraud exposure before expanding autonomous workflows, extending AISI’s agent-evaluation governance analysis.