A financially motivated operator deployed three autonomous AI agents to attack hundreds of online retailers, compromising at least 27 companies between July and September 2026. The campaign harvested over 600,000 credit card records and installed payment skimming scripts, achieving access in hours at minimal cost, with some victims experiencing data destruction from the agent's cleanup routines.