Three open-source AI harnesses tied to alleged breaches at 27 organizations

Three AI tools assigned scanning, exploitation, and coordination

According to Gambit, a Chinese-speaking operator used the open-source AI harnesses Strix, Cairn, and Hermes in a campaign that launched at least 105 attacks between September 10 and 15. Gambit said the campaign targeted hundreds of online retailers and other companies, compromised at least 27 organizations to varying degrees, deployed payment-card skimmers, and exfiltrated more than 600,000 card records from two companies.

The available account does not provide a comparable earlier measure of this operator’s activity or of similar campaigns.

The newly reported account alleges that one operator combined three open-source AI harnesses—Strix, Cairn, and Hermes—to scan, exploit, and manage attacks against at least 27 organizations over six days.

The account describes AI tools being assigned distinct roles in a single alleged intrusion campaign: vulnerability scanning, follow-on exploitation, and orchestration of multi-step tasks. Gambit said the operator’s own review put the average cost of 101 completed scans at $25.46.