FlawOpen

flawopen.com/Incidents/ai-agent-retail-skimming-campaign-september-2026

● Multiple online retailers (as reported by Gambit Security) · CWE-89 (one documented chain only) · 2026-09-22 · Critical
FlawOpen Security Research

AI Retail Skimming Campaign: Gambit’s 2026 Report

Gambit reports human-directed AI attacks on online retailers. We separate its evidence from unverified claims and explain defenses.[1]

💡 Plain English Explainer (ELI5)

Imagine a shop clerk who builds a filing instruction by pasting text from a visitor’s email field into it. A specially shaped request can change the instruction, expose the temporary access code stored in a customer’s file, and let someone present that code at the manager’s door. A parameterized query is like making the clerk treat the email only as the label to look up, never as part of the instruction. The campaign report describes one such SQL-injection-to-admin path; it does not show that every victim followed it.[1], [5]

Core Concepts & Subsystem Terms

AI harness
Software that gives a model tools, task state, and permission to act. Gambit says the operator used Strix for vulnerability search, Cairn for exploitation projects, and Hermes for orchestration; a human supplied instructions.
Payment skimmer
Unauthorized code or content that captures payment information from a checkout flow. Protecting the checkout means controlling every code, configuration, cache, storage, and deployment path that can change what customers receive.
CWE-89 (SQL injection)
Untrusted input changes the meaning of a SQL statement. Gambit describes one documented project that began with SQL injection; this CWE does not classify every intrusion in the campaign.
Evidence confidence
Gambit says it combined recovered staging-server artifacts, skimmers it verified on websites, and agent logs or claims. It warns that its interim reconstruction is incomplete and may contain inaccuracies.
Severity label
FlawOpen’s Critical rating is an editorial impact assessment, not a CVSS score; no CVSS score is assigned.

Framework mappings

Incident Timeline

2026-07 onward

Gambit says the financially motivated campaign began and remained active when it published its interim report.[1]

2026-09-10 to 2026-09-15

Gambit reports 105 attack projects and at least 27 companies compromised to varying degrees; some project claims could not be independently verified.[1]

2026-09-22

Gambit published its reconstruction, reporting more than 600,000 unexpired card records in evidence from two victims and skimmers verified on some affected sites.[1]

Step-by-Step Attack Flow

Step 1

A human directs agent tooling

Gambit’s recovered records describe three harnesses used for vulnerability search, intrusion tasks, and campaign orchestration. The report also records human instructions; do not describe the operation as independent of a human operator.[1]

Step 2

One documented path crosses an authentication boundary

In one project, Gambit reports that a SQL injection flaw exposed an account’s one-time-code data and enabled access to an administrator interface. This is one reported chain, not a universal sequence or a verified source-code finding.[1]

Step 3

Access reaches connected systems

Gambit’s example continues through a file-upload weakness and host access toward other systems and secrets. The exact chain varied; this summary omits operational steps and does not imply every stage occurred in each victim.[1]

Step 4

Checkout and customer data are affected

Gambit reports card-skimmer placement on some stores and recovered more than 600,000 unexpired card records from two victims. It also describes a cleanup action that accidentally dropped 180 tables at one retailer. Attribute these findings to the report.[1]

Step 5

Containment must include integrity and recovery

A response must identify the initial access, revoke exposed credentials, restore trusted checkout assets, examine database changes, notify payment partners as required, and verify recovery from clean backups.

Source Code: Flaw vs. Secure Implementation

This generic Python example illustrates only the CWE-89 boundary in one chain described by Gambit; it is not affected-vendor code and performs no network or filesystem actions. Concatenation lets input alter query syntax. A parameterized query keeps the SQL structure fixed and supplies email as a value. Production authentication must also avoid storing one-time codes in plaintext, enforce server-side authorization for every privileged action, and use a narrowly privileged database account. Parameterization fixes this query boundary; it does not remediate other campaign entry points or an already compromised host. The ? placeholder shown here follows Python sqlite3’s qmark parameter style; other database drivers may use different placeholder syntax.[1], [5]

UNPATCHED FLAW
def find_account(conn, email):
    # Generic example only; not code recovered from a victim.
    sql = "SELECT id FROM customers WHERE email = ' " + email + " ' "
    return conn.execute(sql).fetchone()
HARDENED SECURE PATCH
def find_account(conn, email):
    # Bind input as data so it cannot change SQL structure.
    sql = "SELECT id FROM customers WHERE email = ?"
    return conn.execute(sql, (email,)).fetchone()

Engineering & System Hardening Checklist

Sources