Innhold Show
CyberCartel used Claude, Grok and Kimi in an automated attack platform aimed at more than 400 banks, fintech companies and payment providers across Latin America. The AI models had distinct roles in a system that mapped targets, assessed attack paths, produced code and collected stolen secrets.
This is a step beyond criminals asking a chatbot to write a phishing email or fix a script. Security company Straiker says it gained access to the attackers’ own working environment: the orchestration, configuration, shared knowledge base and a database containing 4,493 records. Those records included email addresses, account numbers, API keys, passwords and backdoors.
More than 400 were financial targets, not 400 publicly confirmed breaches. The victims have been anonymized, and the findings come mainly from Straiker’s own investigation. That distinction does not make the case less serious. It keeps the evidence honest while the underlying attack model can scale far faster than people working on their own.
What did Straiker find in CyberCartel’s AI operation?
Straiker found the CARLIY0S attack system inside CyberCartel’s own operational environment. According to Straiker’s October 21, 2026 report, the platform was used against more than 400 financial targets over several months, with commercial AI models assigned to specialized roles.
CyberCartel was not a new gang that suddenly became dangerous after gaining access to AI. The group is believed to have targeted the Latin American financial sector since 2012 and already understood banks, payment platforms and fraud. The AI system appears to have removed an old bottleneck: how many targets a small number of people can investigate and attack.
CARLIY0S was built on PentAGI, an open framework for automated security testing. A Claude instance in Cursor acted as commander, while several Claude-based roles analyzed infrastructure, developed attack code and debated possible routes into a target. A separate role was supposed to make the final decision. Five so-called Grok miners collected secrets in a database named “FinancialSoft,” while Kimi models served as secondary models.
The exact model names in Straiker’s table came from the attackers’ configuration files. That is not independent confirmation that every listed model variant was actually delivered or used. Straiker also marks the role named FABLE as unconfirmed. What the evidence clearly supports is the architecture: multiple models, fixed roles, shared memory and automated tools combined in one operational chain.
What was actually stolen?
The database Straiker examined on September 24, 2026 contained 4,493 records. Researchers found 2,911 email addresses, 903 account numbers, 391 general API keys and 67 plaintext passwords. They also found 51 portal logins, 43 database connections and six explicit backdoors.
The material included 43 credentials from a single fintech company: 11 API keys and 32 cryptographic keys. Straiker says that access could have been used against SPEI, Mexico’s interbank payment system, and connects the finding to observed test transactions. The database also contained 20 JWT signing keys, 20 Keycloak credentials and more than 200 vulnerabilities recorded by the attackers.
This is more tangible than a laboratory demonstration, but the numbers still need to be read correctly. A database record does not automatically prove that a credential still worked, that every vulnerability was exploited or that money was moved. Straiker anonymized the victims, and Tom’s Hardware described attacks against more than 400 institutions. The primary report is more precise: over 400 targets and one combined store of stolen data.
That distinction matters. The serious part is that Straiker says it observed a working attack platform and real secrets, not that every target can be inflated into a confirmed victim. A security story does not become stronger when the numbers outrun the evidence.
How did the attackers use AI agents?
The AI agents were connected to a complete toolchain, not just a chat window. The system used browser automation through Playwright, Python requests, proxies and a shared MCP knowledge graph. Models could read findings, propose the next action and pass work to another role without an operator manually copying every result.
The division of labor is the important part. One role handled reconnaissance and validation, another wrote code and exploits, and several roles could debate possible attack paths before a judge selected what to do next. The Grok miners then gathered secrets in the shared database. Two operator machines read from and wrote to the same knowledge graph, so a target mapped on one machine became visible on the other.
According to Straiker, the attackers bypassed safety filters by presenting the work as authorized red teaming, academic capture-the-flag tasks or responsible vulnerability reporting. When secondary models still refused, the orchestrator moved on to locally stored attack code. That last detail is easy to miss: a model saying no does not stop a system deliberately built with a local fallback.
Execution was automated too. Straiker describes Playwright navigating login flows and administrative interfaces. Once valid access had been obtained, session data could be transferred to faster Python calls. From there, the system could search for database credentials and SSH keys, map internal networks and establish persistent access.
This is what makes the case serious. Claude and Grok did not invent cyberattacks. They were placed inside a machine that connected planning, tool use, memory, execution and collection. The attackers built the same kind of agentic workflow businesses use to automate legitimate work – except this one ended with stolen data. That is the ugly shift: AI made offensive capacity cheaper and easier to scale.
Were Claude or Grok hacked?
No. The report describes the abuse of commercial AI models inside CyberCartel’s own attack platform, not a breach of Anthropic or xAI. The model names in the headline should not be confused with a compromise of the providers’ systems or customer data.
Straiker says it disclosed the findings to the model providers before publication. Anthropic reportedly disabled the credentials used to access Claude, while xAI investigated activity linked to the five Grok miners. That is the right response, but it only closes this particular access route. The platform was designed for multiple models and kept local code in reserve.
This fits a pattern that model providers have already warned about. In November 2025, Anthropic described an espionage campaign against roughly 30 global targets in which Claude was used agentically with little human involvement. The CyberCartel case is not the same campaign, but both show the shift from AI as adviser to AI as orchestrator.
Providers obviously need to detect and shut down abuse. But the security of a bank, online store or payment service cannot rest on the hope that an external model will recognize that a convincingly worded “security test” is really an attack. Safety filtering is one defensive layer, not a magic wall.
What should businesses do now?
Businesses should start by assuming that reconnaissance and attack attempts can arrive at machine speed. Assets, identities and APIs need to be visible to defenders before an agent finds them. An old admin page or a key that nobody owns anymore is exactly the kind of weakness automated reconnaissance can discover and test repeatedly.
Begin with the boring measures that actually work: inventory internet-facing services, remove unused accounts, rotate secrets and deploy phishing-resistant multifactor authentication. API keys and cryptographic keys should have the least access possible, short lifetimes where practical and a clearly named owner. Alert on abnormal use, not merely failed logins.
Bring together logs from identity providers, API gateways, web applications, databases and endpoints. CARLIY0S shows why a single alert can look harmless: reconnaissance happens in one place, a valid session is used somewhere else and data is collected from a third system. Defenders need to see the chain across those boundaries.
Companies running their own AI agents also need an inventory of the tools, data and credentials each agent can reach. Separate credentials between agents, limit network access and make it possible to shut down tool access quickly without destroying logs and evidence. An agent with excessive permissions is a wonderful shortcut for an attacker who takes over the account or workflow.
For individuals, the advice is less exotic. Use unique passwords, turn on strong multifactor authentication and watch alerts and transactions from your bank. If a service reports a leak, change the password there and anywhere else you reused it. AI changes the speed and scale, but stolen passwords still work in the same old, boring way.
AI makes offensive capacity cheaper, not vulnerabilities new
The CyberCartel case does not show that a chatbot can be sweet-talked into magically breaking into 400 banks. It shows something more practical and more uncomfortable: experienced attackers can connect several models to existing frameworks, browsers, proxies, code and shared memory, then work against far more targets at the same time.
That scale is what defenders need to absorb. A small group can let agents map, compare and test attack paths around the clock. The cost of investigating one more target falls, while the company on the other side still has a security team with a limited number of hours in the day.
At the same time, I will not make one vendor report the final word on all 400 targets. The victims are unnamed, the details have not been independently confirmed by banks or authorities, and configuration files do not prove that every model and every module worked exactly as the attackers intended. The sensible response is to take the architecture and the observed secrets seriously without inventing successful breaches where the evidence only establishes targets.
This is not some distant future risk. Attackers have already started organizing AI agents as a working team. Model refusals will not save a company from a system with local attack code waiting in reserve. Defenders need to automate visibility, containment and response accordingly – while keeping people in control of critical decisions.
Frequently asked questions
Did CyberCartel hack more than 400 banks?
No, that has not been publicly documented. Straiker says CARLIY0S was used against more than 400 financial targets across Latin America. Researchers found a database of stolen secrets, but the victims were anonymized and the report does not confirm a successful breach at every target.
Which AI models did CyberCartel use?
According to Straiker, the attack platform used Claude-based roles for analysis, code and decisions, five Grok miners for collection, and Kimi as secondary models. Some exact model names came from the attackers’ configuration and have not all been confirmed as models that actually ran.
Was this a security vulnerability in Claude or Grok?
The report describes abuse through accounts, APIs and deceptive context, not a breach of Anthropic or xAI. Straiker says Anthropic disabled the relevant Claude credentials, while xAI investigated the activity associated with the Grok miners.
How can a company defend against AI-automated attacks?
Inventory exposed services, patch quickly, use phishing-resistant multifactor authentication, restrict and rotate keys, and correlate logs across identity, APIs, applications and databases. Defenders need to detect the complete sequence of activity, not just one isolated alert.
