The prompt ban did not see the path

On 22 September 2026, Gambit Threat Intelligence published a write-up of an ongoing campaign in which financially motivated operators used autonomous AI harnesses against online retailers. Forbes covered the same activity the same day. Neither source named an APT. Both describe Chinese-speaking human operators steering machines that probe, exploit, steal, and clean up.

Gambit recovered an exposed staging server and rebuilt the campaign from it. Activity runs from July 2026 and was still active at publication. Gambit reports that the operator’s own cost review put the mean at $25.46 across 101 completed scans. Forbes reported totals in a different band. The unit economics that matter for this post are Gambit’s: cheap enough that a small team can walk many shops in a week.

Anthropic told Forbes it had identified and banned the account used in the campaign. That stops one account. What the harnesses were allowed to reach once they had a foothold is a separate question.

What the harness walked

Gambit names three harnesses. Strix hunted vulnerabilities. Cairn ran end-to-end exploitation. Hermes orchestrated jobs and took short Chinese steering prompts from a human. Forbes names Cairn and Hermes and adds that DeepSeek, Kimi, and older Claude models were in play through routes that still accepted them, while newer Claude versions blocked the requests.

One completed Cairn project, documented by Gambit, is enough of a chain to study:

Unauthenticated SQL injection on a login email field. OTP values read in plaintext from an OTP table, which bypassed MFA. Admin panel access. Arbitrary file upload with no extension check. Host RCE. A sudo rule that handed root through Python. NFS without root squash. WordPress credentials from configuration, then WordPress admin via the database, then a plugin upload and blog RCE. AWS Secrets Manager dumped. Magento and Aurora data reached. Magento encryption key recovered. Card numbers decrypted.

The chain is an authority path: identity edges, tool edges, data path edges, and secrets past the application wrapper. Forbes also describes operators installing checkout skimmers and instructing agents to wipe card fields after extraction. Gambit reports skimmers ordered against at least 27 named victims and more than 600,000 card records taken from two companies. Forbes says it is unclear whether those cards were cashed out, and we do not speculate.

The human work in Hermes sessions was short steering prompts in Chinese; machines walked the edges. What the victim has to map is every identity, upload sink, sudo rule, secret store, and payment database the agent can still reach.

The miss

Banning a model account answers: can this operator keep calling that vendor API?

A prompt filter answers: did this string look like an injection or a wipe instruction?

Neither answers: after unauthenticated SQLi, which identities, tools, upload paths, privilege escalations, secret stores, and card tables can an autonomous agent still invoke?

That is the gap we described in Authority paths, not prompt filters. Serpio Atlas records what each agent, tool, or harness may call and reach, including binaries and data paths past source.

If your controls stop at “we blocked the model” or “we filtered the prompt,” nobody has mapped what the agent could reach. A dashboard that never named the OTP table, the upload sink, the NOPASSWD rule, or the Secrets Manager path did not review the blast radius this campaign used.

What a secure design review covers

The lightest first engagement is a secure design review of the applications, databases, host controls and identities protecting your data, including agents and MCP servers where present, read against your threat model. Every paid engagement produces an Atlas map of the reviewed system, machine-readable and versioned, which you keep. Findings are routes on that map.

For an ecommerce or payment-adjacent stack, the review is concrete. Checkout and card handling. Admin and OTP identity paths. Upload and plugin sinks. Secret stores and encryption keys. Database roles that can read payment tables. Any agent, MCP server, or automation that can call those edges. The map puts the edges that matter in front of a reviewer. It marks every path that reaches card data as Open (no control), Checked (logged, then allowed), or Gated (stopped for a named operator), so each gets the treatment it needs.

If you run checkout

If you operate online retail, hospitality booking, airline commerce, or any payment-adjacent admin plane, use the Gambit chain as a checklist against your own map.

Ask, in order: which unauthenticated inputs can reach identity tables? Which OTP or MFA stores are readable after that? Which upload or plugin paths become RCE? Which sudo, NFS, or cloud identity edges become root or Secrets Manager? Which encryption keys sit next to card data? Which automation, agent, or MCP connector can invoke any of those without a human in the loop?

If your map cannot answer those questions, scope a secure design review of checkout, secrets, and admin authority against the system you actually run: read what a secure design review covers. If you need proof of an exploitable path, choose a scoped adversarial test.

Sources

Eyal Sela, Gambit Threat Intelligence, AI Agents Are Hacking Online Retailers for $25 a Company (opens in a new tab), 22 September 2026.

Thomas Brewster, Forbes, Huge cyberattack uses Anthropic and DeepSeek AI to target 100 companies (opens in a new tab), 22 September 2026.