AI security infrastructure faces two distinct tests
Two reports put a sharp edge on a familiar security problem: attackers can automate more of the work, and defenders still have to protect messy, interconnected systems. But these are not two accounts of one operation. Gambit Security described a financially motivated campaign against online retailers. Silverfort described a controlled lab exercise. The distinction matters more than the eye-catching numbers.
The retail report concerns activity Gambit says it reconstructed from an attacker’s staging server. Silverfort’s result comes from researchers testing an orchestrated AI agent in a lab. One is a reported real-world campaign; the other is an experiment. Neither, by itself, proves that every organization faces the same threat or that every AI model can reproduce the result.
That is the right starting point for thinking about AI security infrastructure: separate observed activity from demonstrations, then ask what controls each suggests.
What is AI in cybersecurity?
AI in cybersecurity means applying machine-learning or generative systems to security work—such as analyzing data, helping investigate threats, or automating steps in a response. The same broad capabilities can be used offensively. In the cases reported here, software agents and AI harnesses helped carry out sequences of attack activity with less hands-on effort.
“Agentic” AI refers here to systems arranged to take steps toward a goal, rather than merely answer a question. That does not make an agent magically independent. Its actions still depend on the model, tools, instructions, access, and environment around it. Those details are precisely why a result in one setup should not be generalized to another.
For defenders, the practical question is not whether to label a threat “AI.” It is which actions are being automated, what access they require, and whether monitoring and containment can interrupt them.
Gambit’s retail campaign targeted 105 sites
Dark Reading reported Gambit Security’s account of a campaign in September. Over five days, from September 10 to 15, an attacker used three AI harnesses and open-weight and publicly available models to target 105 e-commerce sites. Gambit said at least 27 companies were compromised to varying degrees. It reported that the activity extended further back, to July, and was ongoing at the time of its account.
The reported impact was uneven, not a single uniform breach. Gambit said at least 600,000 payment-card records were taken from two companies; skimmers were installed on five websites; and the remaining affected organizations experienced some level of unauthorized access. The accounts included a Fortune 500 company. Gambit estimated the average cost at $25.46 per completed target.
The company said the attacker used Hermes alongside the Strix and Cairn AI penetration-testing frameworks. Dark Reading described the system as often compromising targets within a day, sometimes in hours. Gambit’s figures and characterization are the source of these claims; they should be read as the company’s incident findings, not as a universal benchmark for attack cost or success.
The implication is still uncomfortable. Work that once demanded a coordinated team may be packaged into repeatable tool-driven steps. A low reported marginal cost can make broad targeting economically attractive, even when individual attempts fail. The defensive burden is not just spotting a clever exploit; it is limiting what a foothold can reach and reducing the time an intruder can operate unnoticed.
Silverfort’s separate lab test reached domain control
Silverfort’s test was a different case entirely. As Dark Reading reported, the company’s researchers used an orchestrating agent and publicly available versions of Claude Opus in a lab exercise to examine how quickly AI could take an initial foothold toward fuller compromise. Silverfort said the simulated attacker reached complete domain control in eight minutes, at a reported total cost of about $12.
That result is a useful warning about speed and the chaining of actions. It is not evidence that the retail attacker used Claude Opus, that the same process happened at any of Gambit’s victims, or that an arbitrary organization can be taken over for $12. It was a controlled test under a specific environment and configuration, as described by Silverfort. The published account does not establish a broad success rate across different networks, identity setups, models, or safeguards.
The limitation is important, not a footnote. Lab demonstrations can reveal where defenders should test their assumptions, but they do not substitute for evidence from varied production environments. “Eight minutes” describes the reported exercise, not a reliable clock for every intrusion.
Still, a fast route from initial access to privileged control is exactly the kind of pathway security teams should map in their own environments. The useful follow-up is to test permissions, authentication, escalation paths, and detection latency—not to assume the headline number will reproduce itself.
How AI is used in cybersecurity
AI can help defenders sort signals, summarize investigations, and automate routine work; it can also help an attacker coordinate reconnaissance, exploit attempts, and follow-on actions. The reporting here illustrates the offensive side: Gambit attributed a multistage retail campaign to an agent-based setup, while Silverfort explored agent orchestration in a lab. These examples do not establish that AI independently discovers every weakness or eliminates the need for human choices and access.
For a security team, AI surveillance should mean purposeful monitoring of behavior and access—not simply buying another dashboard. Watch for unusual authentication, privilege changes, unexpected tool execution, and movement between systems. Connect alerts to action: a detection that arrives after sensitive data is exposed is not much of a control.
Prompt injection is another relevant concern wherever an AI agent consumes untrusted content and has tools or authority attached. These two reports do not establish that prompt injection caused either case, so it would be wrong to attribute the activity to it. The broader design lesson is to treat input, tool permissions, and execution boundaries as part of the threat model rather than assuming an agent will faithfully follow intent.
What AI security infrastructure should prioritize
Start with the consequences of access. Identify the business processes and systems whose disruption or compromise would hurt most, then reduce unnecessary privileges around them. Gambit’s reporting included card theft and skimmers; Silverfort’s demonstration focused on domain control. Those are different outcomes, but both underline the value of stopping an intruder from turning one opening into broad reach.
Next, make the control path observable. Security teams need to know which identities can change privileges, what tools can act on their behalf, and whether suspicious steps can be detected quickly. Exercise the response, too: can the team revoke access or isolate a system before an automated sequence advances? The eight-minute lab result is a reason to measure that in one’s own environment, not to treat eight minutes as a forecast.
Finally, weigh AI controls against the existing security architecture. New AI features do not compensate for excessive permissions, weak segmentation, or slow incident response. IBM and McKinsey have discussed AI and security governance in broader contexts, but these particular reports do not validate any single vendor platform or governance framework. Governance should make ownership, permitted actions, logging, and escalation clear; operational controls must enforce those decisions.
A measured conclusion for defenders
The Gambit report suggests that an attacker may use open-weight and public models with agentic tooling to scale attacks across retail targets at a reported low average cost. The Silverfort account shows that, in one controlled lab setup, researchers reported domain control in eight minutes for roughly $12. They are separate evidence streams, with separate limits.
Together they argue for preparation, not panic. Assume automation can compress some attack steps. Test the paths that matter, constrain identities and agents, and build detection and response around the systems that keep the business running. Don’t turn one campaign and one lab result into a claim about all AI systems—or all organizations.
