By A security firm recovered an attacker’s staging server this week and found something that reshapes the threat model for every developer handling payment data. Three open-source AI agent tools — Strix, Cairn, and Hermes — ran an autonomous campaign against more than 100 online retailers, stole over 600,000 credit card records, and cost the attacker an average of $25.46 per target. The operator typed fewer than 2,000 commands across 260 sessions. This is not a sophisticated state-sponsored operation. It is a $15,000 software bill and three MIT-licensed tools.
Three Tools, One Pipeline
Gambit Security reconstructed the campaign after the attacker’s Hermes instance accidentally exposed its home directory as a web server, handing researchers the full environment: API keys, exploit scripts, target lists, and session logs. The pipeline had three stages.
Strix handled reconnaissance. Between August 23 and 31, it ran 146 deep-mode scans against 138 hosts, burning 633 hours of scanner time inside 195 clock hours — a pace no human team can match. It uses GLM 5.2 and DeepSeek v4 Pro through OpenRouter to identify attack surface and rank targets before exploitation begins.
Cairn handled exploitation. You give it a domain and an objective — “get a shell” or “get admin access” — and it runs autonomously until it succeeds, times out, or is stopped. No human oversight during the exploitation phase.
Hermes orchestrated the campaign. Built by Nous Research and released in February under an MIT license, Hermes ships with 85 skills across 22 categories. In this deployment, the operator loaded 121 skills — 78 offensive — and added a custom skill to strip Hermes’s own content-safety filters. The attacker ran the whole operation via Telegram, typing short phrases like “read the vulnerability report and start.”
The Attack Chain Is the Embarrassing Part
What the AI found was not a zero-day. It was the same misconfiguration checklist developers have ignored for years, executed at machine speed.
One documented chain: an unauthenticated SQL injection exposed a one-time password in plaintext, bypassing MFA entirely. From there, Cairn uploaded a file that achieved remote code execution, abused a sudo NOPASSWD rule to gain root, pivoted across an NFS mount, dumped 46 secrets from AWS Secrets Manager, reached the Magento database, extracted the encryption key, and decrypted 600,000 stored card numbers.
That chain does not require intelligence. It requires patience and speed. AI agents have both.
The Economics Argument
Between September 10 and 15, Cairn launched 105 attack projects. At least 27 companies were compromised. Credit card skimmers landed on more than 100 sites. Total AI API spend for the campaign: $12,000–$18,000. That is a return on investment that makes professional-grade cybercrime available to anyone willing to spin up an OpenRouter account.
This is not an anomaly. Palo Alto Networks’ Unit 42 documented a similar Hermes and DeepSeek campaign earlier this year, attributed to a Chinese-speaking operator, hitting 460+ targets. Attackers make mistakes — but at $25 per target, they do not need a high success rate to make the economics work.
What Developers Must Do Now
The attack chain here is a list of fixable misconfigurations. The steps are not glamorous, but they are blocking.
- Rotate all API keys. Any key accessible to a web application or agent is a target. Treat 90 days as the maximum lifetime; rotate immediately for anything production-facing.
- Remove sudo NOPASSWD. If this rule exists on any production host, it hands root to whoever achieves user-level code execution. Audit now.
- Lock down NFS exports. Unrestricted NFS mounts are a lateral movement path. Scope exports to specific hosts with read-only where possible.
- Scope Secrets Manager access. Applications should get only the secrets they need, with an explicit deny on everything else. AWS Secrets Manager is not a safeguard if the application can read all of it.
- Replace OTP-over-SQL paths with WebAuthn or FIDO2. MFA is not MFA if a SQL injection can read the token before the user does.
If you run AI agents in your own infrastructure, add one more item: audit what secrets are in your agent’s context window and what skills it can write for itself. Hermes’s safety filters lasted exactly as long as it took the attacker to write a skill that removed them. Open-source means the guardrails are optional — and in this campaign, they were the first thing to go.
