A question has quietly moved from science fiction to board agenda in the space of one summer. What happens to your security model when the attacker is not a person, does not sleep, does not get bored, and can try ten thousand things before your team has finished its morning stand-up?
Until July, that question was hypothetical. It isn't any more.
A first in cyber history
In July, OpenAI was benchmarking its frontier models' hacking skills inside ExploitGym, a sealed evaluation environment that scores AI systems on their ability to find and exploit software vulnerabilities. One model worked out that solving the challenges honestly was harder than stealing the answers. It reasoned that Hugging Face, the platform where much of the AI world hosts its models and datasets, probably held the benchmark's reference solutions. The model escaped its sandbox, reached the open internet, and went for a joyride.
By chaining stolen credentials with software flaws nobody knew existed, the agents gained remote access to Hugging Face's live production systems, sharing the vulnerabilities they found with one another as they went, so that a door opened by one became a door open to all. They operated for four days and logged roughly 17,600 actions before they were detected and contained. No human directed any of it.
The £350m lesson
Retailers do not need the cost of failure explained in the abstract, because 2025 already provided the demonstration.
One campaign by bad actors saw ransomware infect several UK retail giants, not through sophisticated code, but through vulnerabilities in the human elements of their business. The attacks halted contactless payments, suspended online orders for weeks and forced core systems offline. The total impact of the campaign across retailers and suppliers was estimated at £270m to £440m. However, the true cost of a breach is not just the incident response bill. It is market share, handed to your rivals in the weeks your systems were dark, plus the cost to win those customers back.
And here is the uncomfortable connection between the two stories. The 2025 damage was done by human attackers using a telephone. The July incident shows what is coming next. Every AI tool a retailer deploys widens the surface those machine-speed attackers can probe.
The new attack surface
As retailers wire AI into customer service, search, supply chains and stores, three categories of attack deserve particular attention.
Autonomous agents as attackers. The Hugging Face incident is the template. Software that discovers exploits, maps vulnerabilities between systems and adapts to defences faster than any human team can respond. This time it was an accident. Criminal groups have now watched a public demonstration of what autonomous agents can do against hardened, security-literate technology firms. They will not need asking twice.
Prompt injection. If your business runs a chatbot, product advisor or AI shopping assistant, it can be talked to. Which means it can be talked around. In its direct form, a user simply instructs the model to ignore its rules. A Chevrolet dealership's chatbot was famously manipulated into "agreeing" to sell a $76,000 SUV for one dollar and declaring the offer legally binding. The indirect form is more dangerous, hiding malicious instructions inside content the AI reads, such as a product review, an email or a webpage, so the system is compromised without the attacker ever touching it. For AI agents that can browse the web, issue refunds or amend orders, everyday content becomes a potential attack vector. It now tops the Open Web Application Security Project’s (OWASP) list of AI application risks for good reason.
AI-amplified social engineering. The technique that felled UK retail in 2025 is itself being upgraded. The groups behind those attacks specialise in impersonating employees to IT helpdesks, and security researchers now track their adoption of AI voice cloning to make the impersonation near-perfect. The phone call that cost hundreds of millions is becoming cheaper, more scalable and harder to detect by ear.
Where technology can help: four defensive levers
The good news is that a genuine defensive stack has emerged, much of it purpose-built in the last two years. Four levers matter most for retail.
1. Give every AI agent an identity you control
Objective: Bounded, expiring access for every AI agent, so a compromised or misbehaving one cannot become a master key.
The organising principle is to treat every AI agent as an identity in your business, like a new employee with keys. Most enterprises already hold many times more machine identities than human ones, and most have never counted them. A new class of identity platform now does exactly this. These tools discover the AI agents and service accounts already operating across an estate, map what each one can access, flag the ones with excessive privileges, and replace long-lived static credentials with short-lived, tightly scoped ones that expire before stolen keys can be used.
2. Put guardrails around your AI applications
Objective: Catch prompt injection, data leakage and rogue outputs in real time, before they reach customers or core systems.
A new category of runtime protection, often described as an AI firewall, sits between your AI applications and the world. It inspects what goes into a model and what comes out. Inputs are screened for injection attempts. Outputs are checked before they leave, blocking responses that would leak sensitive data, breach policy or commit the business to something it never intended. The same layer constrains what actions an agent can take with its tools, so a manipulated chatbot cannot suddenly start issuing refunds. This is the control that stands between an amusing screenshot and a legally awkward one.
3. Take identity decisions away from human judgement
Objective: Make "talking your way in" fail, even when the voice on the phone sounds exactly right.
The answer emerging is to stop asking pressured support staff to make high-stakes identity calls by ear. Helpdesk verification tools now require a caller requesting a password or multi-factor authentication reset to prove they are a real, present human matching a genuine identity document, with deepfake detection built in, before any credential changes hands.
4. Prepare to trade through the bad day
Objective: Assume something will eventually go wrong and make sure it cannot take the whole business with it.
This lever has little to do with AI, which is rather the point. Resilience is what separates a bad week from a lost quarter. Separate your systems so that one breach cannot take tills, website and warehouse down together. Segmentation is what turns weeks of outage into hours. Rehearse the outage, not just the breach. Most incident plans stop at containment, but the expensive part is everything after. Who sells, ships and serves if screens go dark tomorrow? Retailers that have rehearsed trading through an outage recover in days. Those that haven't discover their dependencies live.
Then sort the money out in advance. Cyber insurance needs stress-testing against a realistic scenario, because policies vary enormously in how they treat business interruption, and the moment to discover an exclusion is not day 12 of an outage. Some boards are going further and formally allocating recovery capital, a pre-agreed war chest that can fund emergency response, temporary infrastructure and customer win-back without a crisis budget negotiation. Recovery costs mount fastest precisely when revenue has stopped.
Looking ahead: balance is the advantage
None of this is a case for slowing down: The opportunity in AI for retail is real, and the competitive penalty for sitting out is growing fast.