Skip to content

DEV Community

Sofia_ Humanbound for Humanbound

Posted on Sep 25

Three Open-Source AI Agents, $25 a Target: What the Gambit Breach Actually Shows

#ai #agents #security

A single operator spent $12,000-18,000 total and broke into at least 27 companies in six days, using three unmodified open-source AI agent frameworks and almost no hands-on effort. Gambit Security reconstructed the whole campaign after recovering the attacker's own staging server. Average cost per breached company: $25.46. The same week, reporting emerged that OpenAI is preparing a security-focused model meant to help catch this kind of thing. One of those two things is already running in production against real companies.

What happened

On September 22, 2026, Gambit Security published a forensic writeup of a criminal campaign it uncovered by recovering an attacker's own staging server, not through any victim's own detection. The reconstruction, later corroborated independently by The Register, BleepingComputer, Hackread, and Forbes, describes a single Chinese-speaking operator who directed three separate open-source AI agent harnesses against real infrastructure with almost no hands-on involvement.

The tools weren't custom-built offensive malware. They were:

Hermes, an agent with persistent memory and self-editing skills, loaded with a "SOUL - Red Team Operator" persona and 121 skills (78 of them offense-focused), running Claude Opus 4.6 through OpenRouter.
Strix, a penetration-testing tool that ran 146 deep-mode scans against 138 hosts over nine days, using GLM 5.2 and DeepSeek v4 Pro.
Cairn, an autonomous exploitation engine chasing shell or admin access, using DeepSeek v4.1 Flash, which launched 105 attack projects in a single six-day window.

The operator's own input, per Gambit, was often as thin as "read the vulnerability report and start."

The attack chain

Exploitation paths weren't scripted in advance; they were worked out dynamically per target. One documented chain: SQL injection, then MFA bypass, then file upload, then remote code execution, then sudo escalation, then NFS access, then database credential theft, then AWS secrets extraction. Per Gambit's director of threat intelligence, quoted by The Register: "Where access was achieved, it usually took less than a day, and in many cases just a few hours."

Between September 10 and 15 alone, the campaign produced at least 27 confirmed breaches out of 105 attack projects launched, hitting a Fortune 500 hospitality company, a major US airline, a large US industrial supplies distributor, a US online fashion retailer, and a run of smaller retailers across bicycles, beauty, firearms, wine, and photography. Two of the victims lost more than 600,000 unexpired credit card records between them, with 19+ skimmer deployments confirmed live in the wild. Seventy-nine percent of the stolen cards were US-issued; the rest were spread across 196+ countries.

Why the price tag is the real story

Mean cost per completed scan: $25.46, ranging from $3.13 to $79.31. Total estimated campaign cost across the whole operation: $12,000-18,000. That is not a research budget. It's a rounding error against what a single successful card-skimming operation nets back, and it bought results against 27+ real companies in days.

Traditional adversarial testing gets scheduled quarterly, staffed with specialists, and priced accordingly. This campaign shows the same category of testing, minus the "friendly" part, running continuously and cheaply, with a human doing little more than approving the next step. The gap between how often organizations red-team their own agent-adjacent infrastructure and how often someone else already is doing it for them, uninvited, is the thing worth sitting with here.

A defensive answer arrived the same week, but only on paper

Fortune reported on September 24, 2026 that OpenAI is preparing a security-focused "GPT-6 Cyber" model and a separate oversight product, expected around its September 29 DevDay, aimed at automated vulnerability patching and better visibility into how its models are being used. It's a reasonable response to a real problem. It's also, as of this writing, a pre-launch report and a limited alpha program, not something running today. Meanwhile the Gambit campaign was live, working, and already generating stolen card data for months before anyone outside the attacker's own infrastructure knew about it.

That gap, between "a tool exists to catch this" and "this was actually caught," runs through nearly every incident this project tracks. A model or a product can be technically capable of flagging misuse and still not be the thing that's actually watching, at the moment it matters, on the system that gets hit.

What this means if you're running agents anywhere near production

The question this campaign raises isn't whether prompt injection or agent misuse is theoretical. Gambit's writeup makes clear it isn't. The more useful question is whether anyone has actually tried to break your own setup the way this operator broke into 27 others, using the same category of cheap, persistent, chained automation, before someone with fewer scruples does it first.

If you want to see what that kind of testing turns up on your own agent stack:

pip install humanbound

Source and docs live here:

humanbound / humanbound

Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.

humanbound

Open-source adversarial testing engine, SDK, and CLI for AI agents
Attack your agent the way real users and attackers will: live endpoints multi-turn conversations, tool abuse. Then turn every failure into a firewall rule.
Runs locally or against the Humanbound Platform. No login required to start.

Quick Start · Test-to-Guardrail Loop · SDK · Documentation · Contributing

📖 Full documentation lives at docs.humanbound.ai — this README covers the essentials; the docs have the depth.

Why Humanbound

Most testing tools test prompts. Humanbound tests agents: it drives multi-turn conversations against your real endpoint, probes tool use and scope boundaries, and scores the results against your security policy. When tests fail, hb guardrails converts the findings into deployable firewall rules — so the same run that finds a hole also patches it.

Quick Start

Install

pip install humanbound                       # CLI + SDK, core deps
pip install humanbound[engine]               # + OpenAI

…

References

Top comments (0)

Subscribe