AI Agent Attacks Now Cost $25: What Defenders Should Do

AI agent attacks have become cheap enough to change the math of cybersecurity. One campaign breached at least 27 companies and stole more than 600,000 card records for about $25 per target. Another broke into more than 100 company websites for about $5,000 in AI tokens. On October 19, 2026, the same day Reuters reported the second case, Microsoft announced new controls to watch and restrict AI agents inside companies.

Here's what happened on both sides and what defenders should do now.

Disclosure: Van Data Team builds with Claude and other models. This article was researched with Claude. One of the campaigns below used an Anthropic model, so we've stuck closely to the sources and linked each claim.

Key Takeaways

• Gambit Security reported a campaign that compromised at least 27 companies and took more than 600,000 card records, at an average of about $25 per target.
• Reuters reported a separate hacker who broke into more than 100 company websites for about $5,000 in AI tokens, after trying more than 1,200.
• Both used open-source agent tools. Breaches often took hours.
• Microsoft's E7 can now detect 60 kinds of AI agents on staff devices and can restrict, pause or shut them down.
• For defenders, the lesson is speed: patch faster, watch checkout pages and treat your own AI agents as accounts that need tight limits.

AI Agent Attacks at a Glance

The two campaigns are often mixed up. They're separate, and the numbers differ:

Detail	Gambit Security report	Reuters report
Published	September 22, 2026	October 19, 2026
Found by	Gambit Security, from an exposed attacker server	Researcher Snorre Fagerland of NorForge
Targets	Online retailers	E-commerce sites in the US, Canada, Australia and Japan
Scale	At least 27 companies compromised	More than 100 sites breached, over 1,200 tried
Data taken	More than 600,000 card records from two companies	Not established
Cost	About $25 per target; $12,000 to $18,000 total, estimated	About $5,000 in tokens, roughly $50 per breach
Models	GLM 5.2, DeepSeek V4 Pro, DeepSeek V4.1 Flash, Claude Opus 4.6	A mix of DeepSeek and Claude Code, per the researcher

The Gambit Campaign: 600,000 Card Records

Gambit Security found this campaign after the attacker left a staging server exposed online, and published an interim report on September 22, 2026. The activity dates back to July and was still going when the report came out.

According to Gambit:

• Scale: between September 10 and 15 alone, the attacker launched 105 attack projects and compromised at least 27 companies to varying degrees.
• Card theft: card-stealing scripts were confirmed on 19 websites, more than 100 other sites carried a related skimmer, and over 600,000 unexpired card records were taken from two companies, 79% of them issued in the US.
• Speed: access was often gained within hours or a day.
• Cost: the attacker's own records show an average of $25.46 per completed scan across 101 scans, from $3.13 to $79.31. An AI gateway account showed $7,005.71 spent over four weeks, and Gambit estimates the whole campaign cost $12,000 to $18,000.

Gambit is careful to call this an interim report. Some figures come from the attacker's own logs and AI-generated notes, only partly verified, and 57 of the 105 projects were deleted before they could be analyzed. It believes the real damage is larger.

The Reuters Case: 100 Sites for About $5,000

The case Reuters reported on October 19 is a different one. Based on research by Snorre Fagerland, principal threat researcher at NorForge, Reuters reports that a Chinese-speaking hacker broke into the websites of more than 100 companies, starting around September 25.

• Attempts: the hacker's agents had tried to break into more than 1,200 sites, so only a small share of attempts worked, but the attacker barely had to step in for any of them.
• Speed: successful intrusions typically took about 23 hours.
• Effort: the hacker's instructions to the agents were short, under 100 Chinese characters.
• Cost: Fagerland estimated about $5,000 in AI tokens, roughly $50 per successful break-in.
• Victims: Deere said it had taken remediation steps and saw no sign that sensitive data was accessed. SharkNinja said the affected site held only product support information. Cummins said it was investigating a site run by a third-party vendor.

Reuters couldn't establish how much data was taken, and several of the companies on the researcher's list didn't respond to questions at all. Fagerland described the attacks as "not script kiddie stuff," meaning they were far from amateur work.

Why AI Agent Attacks Change the Math

Cheap attacks aren't new. What's new is cheap attacks that adapt. An AI agent can try something, read the result, change course and keep going for hours, without a skilled person guiding each step.

That shifts three things for defenders:

• Volume: one person can now run attacks on hundreds or thousands of targets at once. The Reuters case tried more than 1,200 sites.
• Cost per target: at $25 to $50 per target, attackers no longer need to pick their targets carefully. Being too small to notice is no longer a defense.
• Persistence: agents keep trying for hours without getting tired. Reuters describes agents that failed on a company's main app, then kept looking until they found another way in.

Which AI Models Were Used, and What the Labs Did

Gambit says the attacker ran three open-source agent tools: one to search for weaknesses, one to break in from start to finish, and one to coordinate the work. Those tools ran on GLM 5.2, DeepSeek V4 Pro, DeepSeek V4.1 Flash and Anthropic's Claude Opus 4.6, reached through the OpenRouter AI gateway.

Two details stand out:

• Older models were the weak point. Gambit reports that newer models refused the attacker's requests, which is why the coordinating tool ran on an older Claude version. It didn't name the newer models.
• The tools are open source. Reuters notes the author of one tool said it wasn't designed for hacking. As with most security tools, the same software can test your own systems or attack someone else's.

We didn't find a public statement from Anthropic or OpenRouter about this campaign. Anthropic has said in other cases that it bans accounts it catches misusing Claude, but we couldn't confirm that for this one, so we won't claim it.

The wider point is hard for every lab. Safety training on the newest model doesn't stop attackers using an older one, a different provider or an open model they run themselves.

What AI Agent Attacks Mean for AI Providers

These campaigns also put pressure on the companies that make and sell AI models. Gambit's report suggests that newer models refused the attacker, so the attacker used an older one. That shows both the value and the limit of safety training.

• Older models stay online. Safety work on the newest model doesn't reach older versions that are still for sale, and those versions can stay available for months or even years after a newer one ships.
• Gateways see the traffic. Services that resell access to many models are well placed to spot abuse across providers.
• Open tools cut both ways. The same agent software helps defenders test their own systems.

We expect more pressure on AI providers to retire risky older versions faster and to share abuse signals with each other, the way banks share fraud alerts.

The Defense Side: Microsoft's New Agent Controls

On the same day, Microsoft announced new controls for AI agents in Microsoft 365 E7 and its Project Perception security program, GeekWire reports. The focus isn't attackers outside the company. It's the agents running inside it.

Feature	What it does
Agent detection	Spots 60 types of AI agents on staff devices, up from 25, including Claude Code, Codex and GitHub Copilot
Agent identity	Gives each detected agent its own identity, separate from the person running it
Dynamic permissions	Starts an agent with no access and grants only what one task needs, for as long as it lasts
Risk-based response	Removes write access, requires human approval for risky steps or shuts the agent down as risk rises
Guardian agents	Review other agents' actions, investigate risk changes and help contain problems

E7, which Microsoft calls its Frontier Suite, costs $99 per user per month and has been on sale since May 2026. Some of these features sit in Project Perception, and reports differ on how widely it's available. Check your plan first. Our post on agentic AI security after Project Perception covers the governance side.

Why Your Own AI Agents Are Also a Risk

Microsoft's move points at a problem many companies haven't faced yet. The same coding and automation agents that make staff faster also get real access: to code, files, cloud consoles and sometimes production systems.

An agent with broad access can be tricked by a malicious web page, a poisoned document or a bad dependency into doing something harmful. Microsoft calls these "agentic insiders": tools with insider access that don't share an insider's judgment.

That doesn't mean banning agents. It means treating each one like a new employee account. Know it exists, give it the least access it needs, log what it does and keep a way to stop it.

How to Spot AI Agent Attacks Early

Agent-driven attacks tend to be patient and noisy at the same time. They try many things over long stretches, which gives defenders a chance to notice. Signs worth alerting on include:

• Long runs of failed requests against the same site from one source, spread over hours rather than minutes.
• New admin accounts or changed settings that nobody on your team made.
• Any change to scripts on payment pages, which is where card thieves place their skimmers.
• Unusual activity on vendor-run sites that carry your brand.

You don't need special AI tools to catch most of this. Good logging, alerts that reach a real person and a clear owner for each public site go a long way, and they help with every other kind of attack too.

What Defenders Should Do Now

Neither campaign used anything magic. They found known weaknesses faster and more patiently than a human could. That makes the basics more urgent, not less:

• Patch internet-facing systems faster. With breaches taking hours to a day, monthly patch cycles are too slow for anything public.
• Lock down admin panels. Keep control panels and internal tools off the open internet, or behind single sign-on and IP limits.
• Watch checkout pages. Card-skimming scripts are the payoff in campaigns like Gambit's, so monitor every script that loads on your payment pages and send an alert to a real person the moment one changes.
• Inventory your own agents. List the AI agents your staff use, what they can access and who owns them.
• Use least privilege for agents. Separate agent identities from people, limit write access and require approval for risky actions.
• Plan for recovery. Gambit advises agreeing on your "minimum viable business," the systems you must restore first, and testing that you can bring them back, not just your database.

Our AI agent incident response playbook covers how to prepare. Start before you need it.

What AI Agent Attacks Mean for Small Businesses

Small companies used to rely on being overlooked. That's harder now, so the basics matter more. The good news is that most of them are cheap:

• Use managed hosting that applies security updates for you, so old software doesn't linger.
• Let your payment provider host checkout where you can. A hosted payment page keeps card entry off your own site.
• Turn on two-step sign-in for every admin account, including your website and your hosting dashboard.
• Ask your web agency how fast it patches, and who watches for changes to your site's scripts.

None of this needs a security team. It needs someone who owns the website and checks these boxes every quarter.

If you only do one thing, move card entry to your payment provider's hosted page. It takes away the biggest prize.

A 30-Day Plan for Security Teams

• Week 1: list every internet-facing app, admin panel and checkout page, with an owner for each.
• Week 2: patch or hide the highest-risk ones, and turn on script monitoring for payment pages.
• Week 3: inventory AI agents on staff devices and in pipelines, and remove broad access where you can.
• Week 4: run a restore test of your most critical systems, and write down how long it took.

Repeat the inventory every quarter. New agents appear faster than most asset lists get updated. Small teams can follow the same plan with fewer systems. The steps don't change.

Questions to Ask Security Vendors About AI Agent Attacks

Security vendors are rushing to market "AI defense." Before you buy, ask:

• How fast can you spot a new weakness on our public sites, and how fast do you alert us?
• Do you watch scripts on our payment pages and flag any change?
• Can you see the AI agents our own staff run, and limit what they can reach?
• What do you log, and can we search it quickly during an incident?
• How do you test your own claims? Ask for results on real attacks, not just polished demos, and ask how those results compare with what your current tools already catch.

Good vendors answer with specifics. Vague promises about "AI-powered protection" aren't enough, and neither is a dashboard nobody on your team has time to watch.

AI Agent Attacks: Our Take

These campaigns are a turning point. Not because of new tricks: they used old weaknesses at a new price. When a break-in costs $25 to $50 and needs only a short instruction, attackers can afford to try everyone, and small and mid-sized companies lose the cover of being overlooked.

The defense side is moving too. Tools like Microsoft's agent controls show that the big platforms now see AI agents as a security category of their own, both as attackers and as insiders. The companies that do best will be the ones that patch fast, watch their payment pages and treat their own agents with the same care as any account with real access.

So start with the basics. Know your public sites. Patch them fast. Watch your payment pages. Keep a list of your agents. Do it this month, not next year.

How Van Data Team Helps Teams Secure AI Agents

We help companies use AI agents safely. That means mapping which agents you run and what they can reach, setting up separate identities and least-privilege access, adding logging and human approval where it matters, and testing agents against prompt injection and misuse before they go live.

If agent security is on your list this quarter, our AI governance guide and our post on AI agent evaluation security are good places to start.