AI-Driven Cyberattacks Target Online Retailers at a Cost of Just $25 Per Breach

The landscape of cybersecurity is undergoing a fundamental shift as the barrier to entry for sophisticated digital assaults continues to plummet. Recent findings from the Israeli security firm Gambit have illuminated a troubling trend: the democratization of high-level hacking through the use of autonomous artificial intelligence. In a striking demonstration of this new reality, a single threat actor managed to target 105 online retailers over the course of just five days, successfully compromising 27 of them. The most alarming aspect of this campaign was not just its success rate, but its staggering cost-effectiveness. On average, the attacker spent only $25 per company to orchestrate these breaches.

This development serves as both a dire warning for the global retail sector and a signal of a burgeoning, unethical "side-hustle" for individuals with moderate technical skills. By leveraging open-source AI frameworks, attackers are now able to automate the most labor-intensive aspects of a cyberattack—vulnerability research, exploitation, and campaign management—at a fraction of the cost and time required for traditional, human-led operations.

The Economics of Autonomous Exploitation

The financial data uncovered by Gambit’s research provides a granular look at the efficiency of modern AI-driven crime. By analyzing the attacker’s account balance on OpenRouter—a platform used to access various AI models—researchers found that the total expenditure over a four-week period ending August 25 was a mere $7,005. When distributed across the numerous targets pursued during that timeframe, the cost of an individual attack becomes remarkably low.

While the average cost sat at $25 per company, the price of entry varied depending on the complexity of the target’s defenses. For the most vulnerable retailers, the cost of a successful breach was as low as $3.13. Even for the most robustly defended targets in the group, the attacker only needed to spend $79.31 in AI processing fees to find a way in. This represents a radical shift in the return on investment for cybercriminals. When a breach that costs less than a tank of gas can yield hundreds of thousands of pieces of sensitive consumer data, the economic incentives for such attacks become nearly irresistible.

The efficiency of these incursions is further highlighted by the speed of execution. Gambit reported that most successful penetrations took only a few hours. In a traditional setting, a human hacker might spend days or weeks manually probing a corporate network for weaknesses, testing various exploits, and attempting to pivot through internal systems. AI removes these temporal bottlenecks, allowing for a high-volume, "spray-and-pray" approach that retains the precision of a targeted attack.

A Specialized Toolkit: Strix, Cairn, and Hermes

The technical foundation of this campaign relied on three specific open-source AI harnesses, each designed to handle a different stage of the cyberattack lifecycle. These tools—Strix, Cairn, and Hermes—function as a coordinated suite that effectively removes the human from the "attack loop."

Strix is utilized for the initial phase of the operation: vulnerability searching. Rather than a simple automated scanner that looks for known software versions, an AI-powered tool like Strix can interpret code and identify logic flaws or obscure vulnerabilities that traditional signature-based scanners might miss. It acts as the "scout," identifying the weakest points in a retailer’s digital perimeter.