== LOCATED FIGURES (file | needle | section heading above it | the sentence) gambit_report.html | 7,005.71 | AI Harnesses | The capture of the account balance on 25 August 2026 records $7,005.71 (US) spent, for a period of four weeks. The operator then ran for three more weeks at about twice the daily volume of model calls, recorded in the agent logs, so the full cost was likely between $12,000 and $18,000. Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company. The operator’s own gambit_report.html | 12,000 | AI Harnesses | The operator then ran for three more weeks at about twice the daily volume of model calls, recorded in the agent logs, so the full cost was likely between $12,000 and $18,000. Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company. The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest tar gambit_report.html | 25.46 | AI Harnesses | The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive. gambit_report.html | 3.13 | AI Harnesses | The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive. gambit_report.html | 79.31 | AI Harnesses | The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive. gambit_report.html | 101 | AI Harnesses | The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive. gambit_report.html | 600,000 | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | More than 600,000 credit card records have been taken, and in one case the agent's own cleanup routine destroyed the victim's data. gambit_report.html | two companies | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | The impact we can account for includes at least 600,000 unexpired credit card details from two companies, the installation of card-stealing skimmer scripts on the websites of five, and some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer. The campaign goes back further, and has impacted at least gambit_report.html | 105 | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. The activity goes back to July 2026 and is still running. gambit_report.html | 27 | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. The activity goes back to July 2026 and is still running. gambit_report.html | 146 | Strix | Between 23 and 31 August 2026 Strix was run 146 times in “deep mode” against 138 hosts, accounting for 633 hours of scanner time in 195 hours of clock time. Some of these reports were the opening of the next stage of the exploitation, handed over to Cairn. Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro. gambit_report.html | 633 | Strix | Between 23 and 31 August 2026 Strix was run 146 times in “deep mode” against 138 hosts, accounting for 633 hours of scanner time in 195 hours of clock time. Some of these reports were the opening of the next stage of the exploitation, handed over to Cairn. Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro. gambit_report.html | 1,951 | Hermes | It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access. For example: gambit_report.html | 121 | Hermes | On this server it loaded a Chinese system persona titled “SOUL - Red Team Operator”, 121 skills of which 78 were attack skills. The operator also added a skill whose purpose is to remove the content security filters of Hermes itself. Hermes is the operator’s console for orchestrating the activity and for direct hacking activities. It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the hum gambit_report.html | opus | Hermes | It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access. For example: gambit_report.html | GLM | Strix | Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro. gambit_report.html | DeepSeek | Strix | Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro. gambit_report.html | 488,372 | Exfiltrated credit card data | 488,372 gambit_report.html | 196 | Exfiltrated credit card data | Remaining 196 countries gambit_report.html | 180 tables | “Database Wipe After Extraction” | A second victim, a bicycle retailer, lost data when the agent created ZQ prefixed staging tables inside the database to hold the data, and the cleanup then dropped 180 tables whose names matched ZQ or Backup, which also impacted backup tables that the victim’s administrators had made. gambit_report.html | 19 of them | Skimmer injection methods | Skimmers were ordered against at least 27 named victims and confirmed in place on 19 of them during the span of this campaign. With the help of security researcher Varys , we detected more than 100 further websites infected with a skimmer associated with this campaign. gambit_report.html | less than a day | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | Where access was achieved, it usually took less than a day, and in many cases just a few hours. We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches. gambit_report.html | staging server | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | Gambit Security's Threat Intelligence team recovered the operator's staging server and reconstructed the campaign from it. Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. The activity goes back to July 2026 and is still running. gambit_report.html | Shadowserver | Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an | We would like to thank the Shadowserver Foundation, Daniel Gordon, and other industry partners for their quick help and availability in notifying impacted organizations, taking down infrastructure, and conducting research. ibm_newsroom_2026.html | 4.99 million | IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on | , July 29, 2026 / PRNewswire / -- One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report. ibm_newsroom_2026.html | $6 million | IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on | , July 29, 2026 / PRNewswire / -- One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report. ibm_newsroom_2026.html | One in four | IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on | , July 29, 2026 / PRNewswire / -- One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report. ibm_newsroom_2026.html | 602 organizations | IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on | The 2026 report, conducted by Ponemon Institute and sponsored and analyzed by IBM, is based on breaches experienced by 602 organizations globally between March 2025 and February 2026. The follow-on study was conducted in May 2026, where 456 organizations of the 602 from the CODB research responded. Of these organizations, 78% or 356 of organizations were aware of recent reports about highly advanced frontier models such as Mythos. ibm_newsroom_2026.html | Ponemon | IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on | In separate follow-on research conducted by Ponemon Institute, 85% of organizations said they plan to increase security spending after becoming aware of advanced frontier AI cyber capabilities – compared to just 64% that reported in the initial research that they plan to increase security spend after experiencing a breach. ibm_report_page.html | model inversion | (no heading above) | The global average breach cost, in USD, of an AI model inversion attack, reflecting the growing difficulty of protecting training data and sensitive information. ibm_report_page.html | per record | NOT FOUND == CARDS BY COUNTRY (Gambit, 'Exfiltrated Data' table), sum and share check United States 488372 in page: True United Arab Emirates 13559 in page: True Saudi Arabia 6785 in page: True United Kingdom 6522 in page: True New Zealand 5710 in page: True Ireland 5483 in page: True Singapore 5305 in page: True Kuwait 4676 in page: True Australia 4672 in page: True Hong Kong 4459 in page: True France 4295 in page: True Qatar 4075 in page: True Remaining 196 countries 64025 in page: True TOTAL 617938; US share 79.0% == DERIVED (the attacker's side) per card on the metered spend: $0.0113 (= 1.13 cents) per card on the projected total: $0.0194 - $0.0291 (= 1.94 - 2.91 cents) 101 completed scans x $25.46 = $2571.46 (scan spend inside the metered $7,005.71) == DERIVED (against IBM 2026, primary-verified figures only) metered spend / one average AI-enabled breach ($6,000,000): 0.117% projected high ($18,000) / $6,000,000: 0.30% one average AI-enabled breach buys 856 campaigns at the metered spend, 333 at the projected high == MODEL LIFECYCLE (anthropic_model_deprecations.md, 'Model status' table; openrouter_models.json) line 76: | claude-opus-5-5 | Active | N/A | Not sooner than September 22, 2027 | line 77: | claude-opus-5 | Active | N/A | Not sooner than July 24, 2027 | line 78: | claude-opus-4-8 | Active | N/A | Not sooner than May 28, 2027 | line 79: | claude-opus-4-7 | Active | N/A | Not sooner than April 16, 2027 | line 80: | claude-opus-4-6 | Active | N/A | Not sooner than February 5, 2027 | line 81: | claude-opus-4-5-20251101 | Active | N/A | Not sooner than November 24, 2026 | line 82: | claude-opus-4-1-20250805 | Retired | June 5, 2026 | August 5, 2026 | line 83: | claude-opus-4-20250514 | Retired | April 14, 2026 | June 15, 2026 | OpenRouter listing (created = listing date, UTC; price per million tokens in/out): anthropic/claude-opus-4.5 listed 2025-11-24 $5.00 / $25.00 anthropic/claude-opus-4.6 listed 2026-02-04 $5.00 / $25.00 anthropic/claude-opus-4.7 listed 2026-04-16 $5.00 / $25.00 anthropic/claude-opus-4.8 listed 2026-05-27 $5.00 / $25.00 anthropic/claude-opus-5 listed 2026-07-24 $5.00 / $25.00 anthropic/claude-opus-5.5 listed 2026-09-22 $4.00 / $20.00 z-ai/glm-5.2 listed 2026-06-16 $0.65 / $2.04 deepseek/deepseek-v4-pro listed 2026-04-24 $0.96 / $1.91 deepseek/deepseek-v4.1-flash listed 2026-09-10 $0.04 / $0.29 Opus versions listed on OpenRouter before the campaign's Cairn week (10 Sep 2026): claude-opus-4.1, claude-opus-4.5, claude-opus-4.6, claude-opus-4.7, claude-opus-4.8, claude-opus-5 == SECONDARY ONLY (primary gated behind IBM's form; NOT verified here): $192 per customer-PII record if taken as reported: one card record at $192 vs 1.13 cents to steal it = 16935x