Company
Security company that builds an open-source autonomous penetration-testing agent for reconnaissance and credential discovery.
Gambit Security says an operator chained three open-source AI tools to steal more than 600,000 unexpired card records from two companies. The operator's own review put the average completed scan at $25.46.
Reality
Amazon Bedrock now offers Z.ai's 753B-parameter mixture-of-experts GLM 5.3 as a managed API, available only to eligible enterprise customers. Coding-agent teams can call a model that size without running inference hardware of their own.
Reality
Gambit Security says one operator used three AI agent tools to steal over 600,000 cards, spending an estimated $12,000 to $18,000. One retailer's scheduled job reinstalled a skimmer after a deploy removed it, so recovery tests have to cover every layer the agents touched.
Reality
Gambit says a single actor pointed the Strix, Cairn and Hermes agent frameworks at online retailers from July onward, taking more than 600,000 valid card records from two victims and leaving skimmers on 119 sites.
Reality
The credential was in history[].created_by, expanded there by a RUN command that took a build argument, inside a Harbor project anyone could pull anonymously. Baseten rotated it about 17 hours after the disclosure email.
Reality