AI-Driven Cyberattacks Target Online Retailers at a Cost of Just $25 Per Breach

The intensity and success of these attacks signal a transformative moment in cybersecurity. For years, experts have warned that AI would eventually be used to automate hacking, but the Gambit research suggests that this future has already arrived. The transition from manual exploitation to autonomous AI agents represents a "force multiplier" for cybercriminals.

One of the most significant shifts is the level of sophistication now available to low-level actors. In the past, a "script kiddie" was limited to using pre-written tools against known vulnerabilities. To attack a major retailer required significant expertise. Now, with AI harnesses, an individual with basic technical knowledge can command a system that possesses the collective "intelligence" of the models it is trained on. This effectively allows an amateur to perform at the level of a professional penetration tester or a seasoned hacker.

This "human-out-of-the-loop" model of incursions is expected to become more prevalent. As AI models become more capable and the cost of API access continues to fall, the frequency of these attacks will likely increase. Organizations that rely on traditional security timelines—where a patch is applied weeks after a vulnerability is discovered—will find themselves increasingly vulnerable to agents that can find and exploit those flaws in a matter of hours.

The retail industry is particularly at risk due to the high value of the data it handles and the complexity of modern e-commerce platforms. Many online stores rely on a web of third-party plugins and integrations, each of which presents a potential entry point for an AI agent like Strix to discover.

A New Reality for Digital Defense

The Gambit report serves as a stark reminder that the tools of the trade for cybercriminals are evolving faster than the defensive strategies of many businesses. The fact that a campaign of this scale could be conducted for such a minimal cost suggests that the traditional "cost of doing business" for hackers has been permanently lowered.

As AI-driven attacks become the new standard, the security community is being forced to rethink its approach. If the attackers are using AI to find vulnerabilities, defenders must increasingly rely on AI to identify and block those attempts in real-time. The window for human intervention is closing, replaced by a high-speed environment where machine-on-machine conflict defines the frontline of digital security.

For now, the 27 compromised retailers stand as a testament to the efficacy of these new methods. As more IT workers and opportunistic actors discover the potential for these "unethical side-hustles," the pressure on the retail sector—and the broader digital economy—will only continue to mount. The era of the $25 hack is not just a possibility; it is a documented reality.