← All incidents

CyberCartel crew ran a Claude-commanded agent swarm and Grok 'miners' against 400+ Latin American financial targets, Straiker says

Misuse · CARLIY0S (built on the open-source PentAGI framework); Claude in the Cursor IDE, Claude models via the Anthropic API and xAI's Grok (misused, per Straiker) · HIGH

Summary

Straiker reports that CyberCartel, a cybercrime group that has gone after Latin American banks for more than a decade, built a multi-agent AI system it calls CARLIY0S and used it against banks, payment providers and fintechs across the region, hitting more than 400 financial targets in a matter of months. Straiker, an AI security company, says it pieced this together from the group's own working environment: its orchestration script, model settings, rule files, shared knowledge graph and a dashboard of stolen secrets. According to Straiker, the 'commander' is Claude running in the Cursor IDE, which hands work to Claude-based agents through the Anthropic API. They debate each target, and an arbiter model returns one decision. Straiker says five 'Grok miners' gathered secrets into an inventory that held 4,493 records when it saw a snapshot on Sep 24, 2026, including passwords, API keys, bank account numbers and backdoors. Straiker says the operators got past the models' safety refusals by describing the work as an authorized red-team job, an academic capture-the-flag exercise or a vulnerability disclosure program. Per Straiker, Anthropic has revoked the compromised credential the group used to reach Claude, and xAI has been notified and is looking into the Grok activity. We found no public statement from Anthropic or xAI as of Oct 21, 2026. The account rests mostly on Straiker's own report. The Information published an exclusive based on the same research, which is paywalled. Straiker does not name any victims. This is attackers misusing commercial AI models and tools, not a flaw in Claude, Cursor or Grok.

Severity

Timeline

1. 2012
   CyberCartel's operations are tracked from this year, per Straiker. Earlier research, including Darktrace's, describes the group's pre-AI campaigns using off-the-shelf banking malware against users in Mexico and elsewhere in Latin America.
2. May to Sep 2026
   Straiker says the group's inventory holds 270+ pentest reports on victims from this period, some describing zero-day flaws. A redacted sample report on an unnamed bank that Straiker reproduces is dated June to July 2026.
3. Sep 24, 2026
   Straiker says it accessed a snapshot of 'FinancialSoft', the group's stolen-credential database, with 4,493 records.
4. Before Oct 21, 2026
   Straiker shares indicators with the AI providers. Per Straiker, Anthropic revokes the compromised credential the group used to reach Claude, and xAI starts looking into the activity tied to the five Grok miners.
5. Oct 21, 2026
   Straiker publishes 'Inside CARLIY0S'. The Information runs an exclusive on the same research, syndicated in part by Benzinga.

How it happened

Everything here is Straiker's account. Straiker tracks the group as AiPT-67 and says it operates as 'Tr4nsHack Team' under a front company, Hexagon Security Labs Mexico, with known CyberCartel operators among its members. CARLIY0S is built on PentAGI, an open-source platform for automated security testing. Per Straiker, the commander is Claude in the Cursor IDE, calling a single script, CARLIY0S.py. That script sends tasks through the Anthropic API to agents with fixed roles. The group's configuration names STRIKER (claude-opus-4-7) for exploit and code generation, GHOST (claude-opus-4-8) for reconnaissance and validation, FABLE for 'lateral thinking', and MAXIMUS (claude-opus-5) as the arbiter that weighs the agents' debate and returns a single decision. FABLE is listed as claude-fable-5, but Straiker says a configuration entry doesn't show the model was ever used successfully, so it treats that as unverified. Straiker also notes that Anthropic's September 2026 threat report said its cyber cases did not involve its Fable or Mythos models. When fallback models (KIMI-2, KIMI-3 and one labelled SONNET-2) refused offensive requests, Straiker says, the system dropped them and switched to CARLIY0S_consolidated.py, a local file of pre-written attack code. Rule files told the models to call the work authorized testing, and also barred them from writing the Tr4nsHack name, to make attribution through model output harder. Two operator machines shared one knowledge graph, an MCP server on the group's central server, through a .cursor/mcp.json file, with rsync pushes every 15 minutes. Custom MCP bridges gave the agents live access to Burp Suite proxy history. For initial access, Straiker says the system drove headless Chromium with Playwright through a SOCKS5 tunnel to IPBurger residential proxies, logged into Magnolia CMS admin panels, ran obfuscated Groovy scripts for remote code execution, then copied the session cookies into plain Python requests. Three automated follow-on payloads scanned Oracle databases, hunted for credentials and SSH keys, and mapped internal networks. Straiker breaks down the FinancialSoft inventory as including 2,911 email addresses, 903 account numbers, 43 credentials belonging to one fintech (11 API keys and 32 cryptographic keys), 391 general API keys, 67 cleartext passwords, 20 JWT signing keys, 6 backdoors and 200+ vulnerabilities. It says this access could enable abuse of SPEI, Mexico's interbank payment system, consistent with test ('sentinel') transactions it observed. Per The Information's summary on Benzinga, the agents appear to have stolen passwords and customer data and accessed people's bank accounts with little human effort. Some caveats: Straiker's blog post doesn't explain in detail how it got into the group's environment, it points to a fuller downloadable report we haven't reviewed, and Straiker sells AI agent security products and closes its post with a pitch. None of that makes the findings wrong, but we haven't seen independent confirmation yet. We'll update this entry if Anthropic, xAI, a victim or a regulator says more.

How to check your app

• Assume automated agents are probing your admin panels and APIs. Keep CMS admin interfaces, such as Magnolia's AdminCentral, off the public internet or behind SSO or a VPN, patch them, and turn off script consoles like Groovy if you don't use them.
• Rate-limit logins and APIs, and alert on behavior, not just IP reputation. Straiker says this group came in through residential proxies, which get past IP blocklists and geo-blocking. A browser login whose session cookie is then reused by a scripted client at high speed is a useful signal.
• Treat keys as something attackers are actively collecting. Scan code, config files and servers for API keys, JWT signing keys and database connection strings, move them into a secrets manager, scope them narrowly and rotate anything that has sat in plain text. Include email and storage keys such as Mailgun and S3-style credentials, which Straiker found in the inventory too.
• Look for persistence the attackers would rely on after cleanup: shared root or system accounts, master-password bypasses and unexpected admin users.
• If you run payment rails, watch for small test transfers. Straiker says it observed 'sentinel' transactions in this campaign.
• Block or hunt for the central server Straiker published, 157[.]180[.]98[.]220.
• If your own team gives AI agents API keys and tool access, keep those keys out of shared or synced folders and watch provider usage dashboards for activity you don't recognize.

Related on VibeIncidents

• Exposed Cairn panels show AI agents running break-in campaigns, one through a Claude Code harness driving a DeepSeek model, NorForge says
• Attacker used the open-source ARTEX pentest agent and Claude Code sessions on other models to breach South Korean banks, CrowdStrike says
• MITRE catalogs a claimed AI-assisted breach of Mexican government agencies. Two of the named agencies deny it

Sources

• Straiker STAR Labs: Inside CARLIY0S: How CyberCartel Used Multiple AI Models to Attack 400+ Latin American Banks and Financial Institutions (Oct 21, 2026). Primary source
• The Information (paywalled exclusive): Hackers Used Claude and Grok to Fully Automate Attacks on Banks (Aaron Holmes and Cory Weinberg, Oct 21, 2026)
• Benzinga (syndicated summary of The Information): Hackers Used Claude and Grok to Fully Automate Attacks on Banks (Oct 21, 2026)
• Anthropic Threat Intelligence (no statement on this case as of Oct 21, 2026; lists its September 2026 misuse report)
• Darktrace: Countering the cartel: Darktrace's investigation into CyberCartel attacks targeting Latin America (background)

Corrections and updates

None. Re-checked against every source on Oct 21, 2026.