AI-Powered Campaign Targets Hundreds of Online Retailers

Somebody has finally shipped the thing the doomers spent a decade describing, and the invoice is landing with a Chinese-speaking crew who are in it purely for the money — which is somehow more humiliating than ideology would have been. The toolkit, per SecurityWeek, is an open-source AI agent called Hermes and a penetration testing tool called Strix. Hermes is the messenger god, the one who also stole Apollo's cattle the first time he appeared in literature. Nobody planned that resonance, but it is the review the product deserves. The agent is free, the tool is legitimate, and the barrier to entry is now roughly a laptop and a grudge.

Between August 23 and 31, the operators ran Strix 146 times in a setting called 'deep mode' against 138 hosts. That is one host per run, roughly sixteen runs a day, nine days straight — no scoping call, no change-management window, no junior consultant billing by the hour to explain what he found. 'Deep mode' was the option they chose; shallow mode presumably sends a polite email first and waits. Since July 2026 the campaign has touched at least tens of companies, reaching a Fortune 500 hospitality company and three US firms, one of them an airline.

The headline promises hundreds of online retailers; the body says at least tens of companies, which is the customary gap between the pitch deck and the discovery document. And there is nothing here to ban. Hermes is open source, Strix is a legitimate penetration testing tool sold to the people trying to plug the holes, and the only licence anyone could revoke belongs to software whose stated purpose is finding the gaps before somebody less courteous gets there first. Which is precisely what happened. The tools worked exactly as advertised, the defences didn't, and the firms now know their own networks slightly better than they did in July. Small mercies.