FlagThis — Daily Cybersecurity Intelligence Briefing

Autonomous AI agents built on LLM frameworks (e.g., AutoGPT, BabyAGI) are being repurposed to probe and exploit retail eCommerce APIs, automating credential stuffing, API reconnaissance, and token theft to harvest payment card data at machine speed. By mimicking legitimate shopping behavior, rotating residential proxies, and evading WAF/bot defenses, these agents reduce dwell time to under six hours and have already compromised ~395 organizations in a single campaign. The attack surface expands as retailers expose omnichannel APIs without adequate bot mitigation, behavioral anomaly detection, or strict API‑level authorization.