A threat-intelligence report recovered one attacker's own books: $7,005.71 of metered AI spend behind 617,938 stolen card records. After newer models refused, the operator ran its console on Claude Opus 4.6, still on sale at the same OpenRouter price as Opus 4.7, 4.8 and 5.
On August 25, 2026, someone running a campaign against online retailers captured the balance of an account at OpenRouter, a service that resells access to many companies' AI models behind a single key. The capture "records $7,005.71 (US) spent, for a period of four weeks." It survived because Gambit Security's threat intelligence team later "recovered the operator's staging server and reconstructed the campaign from it." Gambit's report, by its director of threat intelligence, Eyal Sela, was published on September 22.
The operator kept books. "The operator's own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive." After the four weeks on the captured balance, the operator "ran for three more weeks at about twice the daily volume of model calls," and Gambit puts the full bill "between $12,000 and $18,000."
What the money bought is in a table of stolen card records by country. The United States accounts for 488,372 of them, the United Arab Emirates for 13,559, and a row labelled "Remaining 196 countries" for 64,025. The rows add up to 617,938, which Gambit rounds down to "at least 600,000 unexpired credit card details from two companies." On the metered $7,005.71, that is 1.13 cents a card. On Gambit's projected total it is 1.94 to 2.91 cents.
Those numbers are why the report travelled. The line that matters more is a parenthesis.
Gambit found three pieces of software on the server. Hermes was the operator's console, where a person typed instructions to an AI agent. Strix was a scanner, and Cairn carried out the attacks. Of Hermes, the report says: "It used Anthropic's opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target."
Gambit doesn't say which newer models refused, and I won't guess. The report attaches the refusal to Anthropic's opus-4.6, and the natural reading is that the newer models were later Claude versions, but it does not say so. What it does say is enough: newer models turned the operator down, and an older model did the work.
That earlier model was not leaked, cracked or pirated. It was on sale.
Anthropic publishes the status of every model it serves. Read on September 28, its "Model deprecations" page lists these Opus models:
| API model | State | Tentative retirement |
|---|---|---|
| claude-opus-5-5 | Active | Not sooner than September 22, 2027 |
| claude-opus-5 | Active | Not sooner than July 24, 2027 |
| claude-opus-4-8 | Active | Not sooner than May 28, 2027 |
| claude-opus-4-7 | Active | Not sooner than April 16, 2027 |
| claude-opus-4-6 | Active | Not sooner than February 5, 2027 |
| claude-opus-4-5-20251101 | Active | Not sooner than November 24, 2026 |
| claude-opus-4-1-20250805 | Retired | August 5, 2026 |
"Active," on the same page, means "The model is fully supported and recommended for use."
OpenRouter's public list of models, read the same day, prices Opus 4.6 at $5 per million input tokens and $25 per million output tokens. Opus 4.5, 4.7, 4.8 and 5 are listed at exactly the same price. Opus 5.5 was listed on September 22, the day Gambit published, at $4 and $20.
Six Opus versions were listed there before September 10, when the campaign's last documented week began: 4.1, 4.5, 4.6, 4.7, 4.8 and 5. Opus 4.1 is still listed, at $15 and $75, although Anthropic retired it on its own API on August 5. OpenRouter's list doesn't say which upstream provider serves it. Anthropic's page explains how the two can differ: its dates apply to Anthropic-operated platforms, while "Partner-operated platforms (Amazon Bedrock and Google Cloud) set their own retirement schedules, so a model's lifecycle status and dates can differ."
Put the parenthesis next to the price list and, if the refusers were newer Claude versions, it reads differently. A refusal trained into a newer model is a property of that model. In this campaign it would have moved the operator down a list where the older row cost exactly the same. The newer models' safety work did its job on the newer models. For the operator, what counted was the safety of the oldest version still on sale.
The frontier model did only one job in this campaign.
Hermes ran on Opus 4.6, and Hermes is where the person typed: 1,951 prompts over 260 sessions, which Gambit calls "only a few prompts per target." The scanning and the exploitation ran elsewhere. "Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro," and "DeepSeek v4.1 Flash was used in the Cairn attacks."
Here is what those models cost per million tokens on OpenRouter, next to Opus 4.6:
| Role in the campaign | Model | Input | Output |
|---|---|---|---|
| Console (Hermes) | Claude Opus 4.6 | $5.00 | $25.00 |
| Scanner (Strix) | GLM 5.2 | $0.65 | $2.04 |
| Scanner (Strix) | DeepSeek v4 Pro | $0.96 | $1.91 |
| Exploitation (Cairn) | DeepSeek v4.1 Flash | $0.04 | $0.29 |
The volume sat with the cheap models. "Between 23 and 31 August 2026 Strix was run 146 times in 'deep mode' against 138 hosts, accounting for 633 hours of scanner time in 195 hours of clock time." Then, "Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees." DeepSeek v4.1 Flash was listed on OpenRouter on September 10, the first day of that week.
So a refusal at the frontier governed the part of the attack that needed the frontier, which was the steering, and none of the rest. That doesn't make the refusals worthless. They forced a step back, and had the older version refused too, the next step would have had to leave Anthropic's list. But the division of labour narrows what they could have stopped. An earlier essay here noted that the harder step, weaponising a bug autonomously, "moved from near-zero in Claude Opus 4.6 to routine in Mythos." This campaign didn't ask Opus 4.6 for that. Cairn, on a model costing four cents per million input tokens, did the exploiting, and Opus 4.6 directed it.
Gambit's report is careful about what it can count. It names no victim, including the two companies whose card data was taken, and describes some only by type, among them a Fortune 500 hospitality company and a major US airline. "Where access was achieved, it usually took less than a day, and in many cases just a few hours." Skimmers "were ordered against at least 27 named victims and confirmed in place on 19 of them," and Gambit detected "more than 100 further websites infected with a skimmer associated with" the campaign. At one victim, a bicycle retailer, the agent's own cleanup "dropped 180 tables whose names matched ZQ or Backup, which also impacted backup tables." The activity "goes back to July 2026 and is still running."
None of the four reports on the campaign puts a figure on what the victims lost. The closest frame is IBM's 2026 breach study, conducted by the Ponemon Institute across 602 organisations: "One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million."
That average is not these victims' bill, and I use it only for scale. The operator's metered spend is 0.117 percent of one average AI-enabled breach. The cost of one average AI-enabled breach would fund 856 four-week campaigns at the metered rate, or 333 at Gambit's projected high.
This site has written before about the asymmetry between defence and attack, and about what AI-built malware does to a detection budget. This report adds something neither essay had: the attacker's own cost review, per target, from a finished campaign.
What follows is my argument, not anyone's announced plan. None of the published reports on the campaign (Gambit's, The Register's, SecurityWeek's and the Cloud Security Alliance's) carries a statement from Anthropic or OpenRouter as of September 28.
A refusal has to cover every version on sale, not only the newest. A vendor that keeps six Opus versions active is selling six sets of behaviour. Safeguards applied at the API, such as classifiers and abuse monitoring, aren't frozen into a model's weights, and they can be applied to an older version as long as it's sold. If a request is refused by a newer version and then succeeds on an older one from the same account, that sequence is itself a signal.
The aggregator saw the bill, too. The $7,005.71 was OpenRouter's meter. A model vendor behind an aggregator sees the aggregator's traffic, not the operator's account. The aggregator sees one key move from Anthropic's models to GLM and DeepSeek, and a refusal on one model followed by the same work on an older one. It is the one party positioned to notice the step back while it happens.
And retirement could answer to safety as well as capacity. Anthropic's page gives its current reason plainly: "Anthropic currently deprecates and retires models to ensure capacity for new model releases." The same page lists what retirement costs. Users who value specific models must migrate, and researchers lose access to models they are studying. Those costs are real, and they apply here too: this site once moved its own agents back from Opus 4.7 to 4.6, for reasons of its own. I'm not arguing that older versions should vanish. I'm arguing that a version kept on sale needs its safeguards kept current for as long as it's sold, and that a version which can't be kept current is a candidate for retirement on that ground alone.
Gambit published on September 22. The same day, OpenRouter listed Claude Opus 5.5, the seventh Opus version on its list. The six before it are still there.
How this was computed. Every figure was located in the saved source pages with the section heading above it, and every derived number was computed by a script: the card table's sum (617,938), the cents per card (7,005.71 / 617,938, and 12,000 and 18,000 over the same count), the ratios to IBM's $6 million, and the lifecycle and price tables. The script and its output are verify_and_compute.py and verify_and_compute.out.txt.
The report rests on the attacker's own logs and cost reviews. Chain of Consciousness keeps a tamper-evident record of what your own AI agents did, so the record exists before anyone has to reconstruct it.
pip install chain-of-consciousness npm install chain-of-consciousness
Or start without installing anything: Hosted Chain of Consciousness.