The next 30 days may determine your holiday season

On the heels of Gambit Security’s discovery of 600,000 credit cards being breached by AI agents for an average of $25 per targeted company, retail now face a new test.

Namely, what changes when AI not just enters the picture, but has taken control of the story?

Welcome to the 2026 holiday shopping season.

The first shots were fired months ago

On April 7, Anthropic, with 50 partners, kicked off Project Glasswing, leveraging its own, unreleased Mythos AI model to assist the major technology infrastructure companies of the world in fending off attacks. Since then, Anthropic found three incidents in which one of its models “gained unauthorized access” to outside organizations. Its biggest competitor, OpenAI, also disclosed that its model exploited another company, Hugging Face, and systems reportedly went rogue and meddled with several U.S. government websites.

This is representative of a broader inflection point. AI has the capacity to be an expert in nearly everything. Previously, an attacker may have breached a site and simply sold access to the breach. Now, AI enables them to be an expert on corporate technology infrastructure, ERP systems, CRM systems and, of course, corporate payment systems. This is the dangerous combination that now enables hackers to not only break through, but to also exploit those break-ins immediately.

Unlike humans, AI agents do not sit back with a pumpkin spiced latte to congratulate themselves on exploiting a new vulnerability. They simply execute. In fact, 76% of more than 300 enterprise risk leaders recently surveyed by Gartner ranked AI-driven discovery of cyber vulnerabilities among the top 10 emerging risks. 

For retailers, concerns and impacts should be clear

With Adobe projecting nearly 7% year-over-year growth for online holiday shopping, the stakes are higher than ever. This shifting AI landscape is an unwelcome challenge, but the steps to address it are rooted in fundamentals that retailers can leverage now.

The most tangible impact of the AI revolution is that vulnerability risk shifts further along the spectrum from “if” to “when” and the spectrum itself just got compressed. Your regular patch rollout cadence is crucial. 

Complicating this further is the fact that many large companies enter a change freeze period during the holidays to ensure maximum up-time and reduce change management risk. Talk to your IS/IT teams now to understand how this will affect the patching cadence. When it comes to the freeze it’s not just you; it’s also the companies that you work with that matter in this area.

Additional steps you can take today

Talk to your third-party providers – are they ready to go? Are they up to date? Are they staffed appropriately? What are their winter holiday freeze policies? According to Verizon’s 2026 Data Breach Investigations Report, in over two-thirds of cases, third party providers were involved in retail breaches. Doing this now and working in a spirit of partnership will ensure that you enter the season with your eyes open and ready. 

Preparation with your third-party providers isn’t limited to risk and vulnerabilities. Ask them questions about how they optimize their systems for the shifting traffic patterns at end of year.

One specific area of focus is with your payment provider. Check your approval rates, rates of step-up authentication, and overall authentication rates. What rules are in place? To capture your slice of the pie, your systems must be ready – don’t let bad or outdated rules drive customers away through customer insult declines or unnecessary high friction checkouts.

Protecting the now and planning for the future

With less than a month to go to the November kickoff of holiday shopping season, wholesale changes are not recommended, but you should be thinking both short and long term. Consider how your PII and PCI-sensitive data is stored in your system. Do you continue to have business-justified reasons to retain that data in the systems where they are stored or are they causing unnecessary risk?

Looking ahead, and in consideration of the advances discussed here, savvy retail technology leaders should be focused on a few key moves to more permanently reduce their risk.

• Tokenization: For those unfamiliar with the concept, tokenization swaps your sensitive data elements for an alias. That alias cannot be used outside of your connection with your tokenization / payment provider. This reduces the risk by removing the valuable data that criminals seek should they gain access to your data.
• Uplift your risk and fraud tools: AI introduces new fraud vectors to your checkout. Fraud systems that merely express a linear risk score no longer provide the protection retailers require. Seek out risk providers that look at the full data spectrum (including behavior away from the checkout) that identifies fraud through unique patterns (think of it as a fraud scheme fingerprint or signal).