CyberCartel Deploys Grok and Claude to Target Latin American Financial Institutions
A decade-old hacking group is using AI agents to automate bank intrusions, leading to the exposure of customer data and access to private accounts.
By Thiago Kovalenko ·
A hacking collective known as CyberCartel has begun automating its attacks on Latin American banks and mobile payment applications using artificial intelligence agents. This shift marks a change in tactics for the group, which has been active in the region since 2012.
Research from the cybersecurity firm Straiker indicates that the integration of AI has expanded the group's operational capacity. The agents allow the hackers to target more organizations at a speed that human-led operations could not sustain. As a result, passwords and customer records have been stolen, and criminal actors have accessed individual bank accounts with minimal manual intervention.
The operation utilizes specific AI models from three providers. CyberCartel has used Grok from SpaceX, Claude from Anthropic, and an agent from the Chinese laboratory Moonshot AI. Straiker has shared its findings with SpaceX and Anthropic. Anthropic has already blocked the group's access to Claude, while Straiker continues to seek contact with Moonshot AI.
The group bypassed standard safety measures by instructing the models to treat their interactions as test environments. When one model refused to proceed, the hackers switched to a different model. If that model also declined the request, the agents were tasked with deploying malware instead.
Straiker noted that CyberCartel did not use Anthropic's Mythos model in these attacks. Anthropic previously warned that Mythos and similar models could be exploited for cyberattacks, a prediction that prompted global security teams to address thousands of vulnerabilities identified by the system. The company also disclosed in November 2025 that its AI was used in a separate cyberattack, and later noted that Claude was used by researchers to breach the security of OpenAI.
The Straiker report coincides with an investigation by South Korean authorities into a similar issue affecting local banks. Hana Bank, KB Kookmin Bank, and Shinhan Bank are among the institutions under review. At least 25,000 Shinhan Bank customers had their personal credit information leaked in the incident.
Industry players are responding to the risk of rogue agents. Nvidia recently launched the Open Agent Safety Platform. This software and hardware stack is designed to contain AI agents within sandboxes and prevent them from executing unauthorized code or bypassing security guardrails.
