Two people are walking through a forest when a lion appears. One crouches to tie his running shoes. The other says, ‘You cannot outrun a lion.’ The answer is familiar: ‘I do not need to outrun the lion. I only need to outrun you.’
For years, that story captured a common approach to cyber risk: an organization did not have to be impenetrable; it only had to be harder to compromise than the next available target. Autonomous AI changes the economics behind that assumption. When testing another company costs about $25, the lion does not have to choose only one runner.
An attack campaign operating at machine speed
In an interim report published on 22 September 2026, Gambit Security said a financially motivated operator used three open-source AI harnesses—Strix, Cairn, and Hermes—to attack online retailers with limited human involvement. Between 10 and 15 September, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. Gambit says the activity dates back to July and was still active when the report was published.
The impact documented by the researchers includes more than 600,000 unexpired credit-card records exfiltrated from two companies and payment-card skimmers placed on multiple retail websites. Of the cards categorized by issuing country, 13,559 were issued in the United Arab Emirates and 4,672 in Australia.
The operator's own review put the average model cost at $25.46 across 101 completed scans. The human often supplied only short instructions; the agents spent hours probing targets, choosing attack paths, pursuing access, and adapting when an approach failed.
The lion is learning to scale
Target selection was systematic. According to Gambit, the operator used a website-traffic ranking service, selected the shopping category, filtered out stores running major hosted or open-source commerce platforms, and kept custom-built sites on the assumption that they were more likely to contain weaknesses. Hundreds of candidates could then be handed to the agents.
AI did not invent the weaknesses used in this campaign. SQL injection, unsafe file uploads, excessive privileges, exposed secrets, and weak segmentation are familiar failures. What changed was the cost, patience, and speed with which they could be combined across many targets.
That distinction matters. The lesson is not that every attack now requires an exotic AI defense. It is that ordinary control gaps can be found and chained at a tempo calibrated security processes were not designed to match. Patch windows measured in weeks compete with autonomous exploration measured in hours.
Being harder to catch is no longer enough
The campaign also created damage beyond theft. Gambit reports that a cleanup routine at one retailer dropped 180 database tables whose names matched broad patterns, including backup tables created by the victim's administrators. Data loss arrived as a side effect of the attacker's automation rather than as the primary objective.
Security programs should respond on two fronts. First, reduce the opportunities agents can test: minimize internet-facing administrative surfaces, remove exposed secrets, constrain service identities, fix known web-application weaknesses, and monitor machine identities as closely as human ones.
Second, design for recovery at machine speed. Identify the minimum systems needed to keep revenue moving, isolate backups from production credentials, and prove through testing that applications—not only databases—can be restored within the required time.
Tying your shoes still matters. Basic security can make an organization a less attractive and less successful target. But when autonomous agents can test hundreds of companies cheaply and patiently, the durable advantage is knowing how to keep running even after the lion reaches you.