Forbes: A Chinese Hacker Used AI to Attack 100+ Companies in One of the Largest AI Hacks Yet

Forbes reported on Gambit research into an attack campaign run almost entirely by AI agents.Between September 10 and 15, 2026, a Chinese-speaking attacker pointed AI agents at about 100 organizations. At least 30 websites were breached.Targets included a major US hospitality company, a large airline and an online fashion retailer. The attacker stole more than 618,000 credit card records, about 488,000 of them from US cardholders.The campaign ran on DeepSeek, Kimi and Claude Opus 4.6, driven by open source agent frameworks. Attacking each target cost between $3 and $180.

Related Content

Gambit's technical report, AI Agents Are Hacking Online Retailers for $25 a Company (September 22, 2026), covers the whole campaign: the three agent harnesses, the attack timeline and what each target cost.