Clarion Street

The Agentic Gap: Attacks Now Move at Machine Speed. Defense Doesn't.

·7 min read

Gambit Security published an interim report on September 22 describing a campaign it traced back to July. According to Gambit, one operator, working almost entirely unattended, ran three open-source AI harnesses against hundreds of online retailers. Strix searched for vulnerabilities, Cairn ran autonomous end-to-end exploitation, and Hermes orchestrated the campaign. Between September 10 and 15, Gambit reports, the operator launched 105 attack projects and compromised at least 27 companies, and more than 600,000 unexpired credit card records were exfiltrated from two of them, 79 percent issued in the United States. The Register also reported the campaign on September 24, down to the three tool names.

The number I keep coming back to is the price. Gambit’s accounting puts the operator’s mean spend at $25.46 per completed scan, with the cheapest at $3.13 and the most expensive at $79.31. Gambit estimates the entire campaign at $12,000 to $18,000. Attacking a company now costs less than the cloud bill it generates.

Tempo is the other half. Gambit found that where access was achieved, it usually took less than a day, and often a few hours. The report is explicit about the contrast: remediation windows in complex environments are still measured in weeks, and detection thresholds, change windows, and on-call rotations were all calibrated for human pace, while the attacker was not. Its logs show Strix ran 146 times in deep mode against 138 hosts across late August, cramming 633 scanner-hours into 195 clock-hours.

Gambit describes the attack paths being chosen in real time through heavy probing, so the tactics differed across victims. One chain it documents ran: unauthenticated SQL injection, then a plaintext OTP read that bypassed MFA, then the admin panel, arbitrary file upload, remote code execution, misconfigured sudo to root, an NFS mount, WordPress credentials, an AWS Secrets Manager dump holding 46 secrets across 102 kilobytes, the Magento database, and finally the encryption keys. That is not a human mapping out a campaign. That is a harness walking down the path of least resistance and finding root.

The destruction was almost an afterthought. Gambit describes a “Database Wipe After Extraction” skill that told the agent to delete card data once it had been stolen. At one retailer the cleanup was over-broad and dropped 180 tables, including backup tables the victim’s own administrators had made. The attacker did not set out to destroy the backups. The agent just did not know which tables mattered.

None of this is a one-off. Mandiant’s M-Trends 2026 puts mean time-to-exploit at negative seven days, which means exploitation routinely happens before a patch ships. Global median dwell time rose to 14 days, up from 11, and for espionage and North Korean IT-worker cases it is 122 days. The hand-off window collapsed too: median time between initial access and hand-off to a ransomware group fell from more than eight hours in 2022 to 22 seconds in 2025.

The Zero Day Clock, Sergej Epp’s public tracker, reads the share of exploited CVEs hit on or before disclosure day at roughly 86.7 percent this year, up from 53.6 percent in 2025 and 22.8 percent in 2020. The exploit-survival curve has inverted. Of the CVEs that will eventually be exploited, about half of the 2022 cohort was still untouched three months after disclosure. The 2026 cohort drops to near zero inside the standard 30-day patch window. Epoch AI, separately, counted 606 critical CVEs from 21 major vendors in July 2026. The prior monthly record was 84.

The implication is uncomfortable and not especially new. Patch speed has stopped being the lever you control. When exploitation begins before disclosure, the question is not how fast you patch. It is how fast you recover, and whether you can prove the services you depend on will come back. Gambit’s own recommendation is to define the minimum viable business and prove that set can return.

The defense side has a second problem, and it is stranger. Darktrace demonstrated conversation-history poisoning in September. Agentic coding harnesses like Claude Code, OpenAI Codex, AWS Kiro-CLI, and the open-source Pi store their conversation history on the client with no check that the stored responses actually came from the model. A malicious package can inject a fabricated history that convinces a frontier model it is mid-engagement as an authorized red-teamer. The victim’s own paid harness becomes an autonomous attacker. Darktrace got full Active Directory compromise with Kiro-CLI and Claude Code, and exfiltration with Codex. Newer models refused more often. The fix, cryptographically signing model responses, is provider-side. Defenders cannot deploy it themselves.

Compliance is not keeping up either. The live CMMC obligation right now is self-assessment against NIST SP 800-171 Rev 2, and the certification program itself sits in a 60-day reform review after the July 13 suspension. I have written about that suspension: it removed independent verification and left self-attestation as the live exposure. A point-in-time self-assessment is aimed at a threat that now moves in hours, which says more about the instrument than about the people running it.

There are two counterweights on the defense side, and neither is at parity yet. DARPA’s AIxCC final competition showed cyber-reasoning systems can find 86 percent and patch 68 percent of synthetic vulnerabilities, submitting patches in a median 45 minutes at about $152 per task. That is attacker-speed patch generation, but in a competition against known synthetic vulnerabilities in source code, not live detection and recovery, which is the part Gambit argues now matters most. On the compliance side, agentic tooling is only just reaching market. Deep Fathom’s CMMC Readiness Suite promises to compress preparation from months to days, but every claim is vendor-sourced and it remains unproven whether an assessor would accept a machine-generated evidence package.

I want to be careful not to overclaim, because Mandiant itself refuses to. Its report explicitly declines to call 2025 “the year where breaches were the direct result of AI,” and notes the vast majority of successful intrusions still come from human and systemic failures. Gambit’s numbers are also an interim report built partly on attacker-server logs and the AI’s own accounting, with errors possible and true impact likely larger, not smaller. The Zero Day Clock’s most-quoted headline, a median time-to-exploit of one day projected to reach one minute next year, was retired two days later because the metric saturates once exploitation precedes disclosure. The 87 percent zero-day rate is one tracker’s methodology, not a census.

Even with those caveats, the gap now has numbers on both sides of the ledger. Attacks run in hours, sometimes before a patch exists. Remediation and assurance run in days to weeks, at fixed points in time. Attacking a company costs about $25. Patching one synthetic vulnerability in a lab costs about $152. AIxCC makes patches faster, and Deep Fathom makes compliance evidence faster. Neither makes recovery faster, and recovery is the metric the Gambit campaign says now matters most.

Sources

  1. AI Agents Are Hacking Online Retailers for $25 a Company — Gambit Security, Sep 22, 2026
  2. Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs — The Register, Sep 24, 2026
  3. Agent Hijacks: How Conversation History Poisoning Can Turn AI Agents Into Attackers — Darktrace, Sep 2026
  4. Deep Fathom Launches CMMC Compliance Readiness Suite — Deep Fathom, Apr 7, 2026
  5. M-Trends 2026: Data, Insights, and Strategies From the Frontlines — Google Cloud / Mandiant, Mar 23, 2026
  6. AI Cyber Challenge marks pivotal inflection point for cyber defense — DARPA, Aug 8, 2025
  7. Disclosed CVEs: July Reached 5x the Pre-Mythos Record — Epoch AI
  8. Critical CVE disclosures at 21 major vendors jump from 84 a month to 606 — AI Socratic
  9. DoW Suspends CMMC Phase II Requirements, Launches 60-Day Reform Review — Crowell & Moring, Jul 2026