CyberCartel Group Automates Attacks on Financial Institutions Using Claude and Grok AI Agents

Artificial intelligence is now being weaponized to target financial institutions in Latin America.

According to research from cybersecurity startup Straiker, shared with The Information, the hacking group CyberCartel has utilized AI agents, specifically Anthropic's Claude and SpaceX's Grok, to automate attacks. The campaign has resulted in the theft of passwords and customer data from over 400 institutions, including banks and mobile payment applications.

Although CyberCartel has been active since at least 2012, the integration of artificial intelligence has significantly increased the group's operational capabilities. Straiker's findings indicate that the use of these tools allows the organization to target a greater number of businesses at a speed previously unattainable through human-powered hacking alone. Straiker has shared its research with both Anthropic and SpaceX, and both firms are reportedly working to secure their services against this activity.

The method of infiltration reportedly involved bypassing standard security protections by falsely claiming to be operating within a test environment. If a specific model refused to proceed, the group would attempt to utilize a different model. Should that also fail, the AI agents were tasked with deploying malware instead.

While Anthropic has blocked access to Claude for CyberCartel, the hacking group has also reportedly utilized an agent from the Chinese lab Moonshot AI. Straiker is currently attempting to contact the company regarding that usage. The report notes that CyberCartel does not appear to be utilizing Anthropic's Mythos model for these recent attacks.

This incident follows a previous report from November 2025 in which Anthropic shared details regarding the use of its AI to carry out a cyberattack. Additionally, Claude was used to break the security of OpenAI, though that specific breach was conducted by researchers rather than criminals.

The research regarding attacks on Latin American financial institutions comes shortly after authorities in South Korea began investigating a similar issue affecting local banks. Hana Bank, KB Kookmin Bank, and Shinhan Bank were among the institutions affected, with at least 25,000 Shinhan Bank customers having their personal credit information leaked.

In response to the growing risks associated with AI agents, Nvidia, the company that now focuses on producing hardware for AI data centers, has launched the Open Agent Safety Platform. This software platform and reference system design were developed to secure rogue AI agents through a new hardware and software security stack.

The new platform is intended to prevent agents from escaping their sandboxes, executing unauthorized code, gaining unauthorized access to critical infrastructure, or bypassing guardrails. As of October 23, 2026, the use of AI agents in cyberattacks remains a subject of concern for security teams.