CyberCartel Automates Regional Heists With Grok and Claude

The hacking collective known as CyberCartel has begun using advanced AI agents to automate its attacks on Latin American businesses, significantly accelerating its ability to steal data. The group has employed models from SpaceX and Anthropic to target banks and mobile payment applications. This shift allows criminals to access individual bank accounts and harvest customer details with minimal manual effort. The discovery comes from recent research by the cybersecurity startup Straiker, which highlighted how artificial intelligence is reshaping the landscape of digital crime.

CyberCartel has been a persistent threat to the region since at least 2012. However, its recent adoption of AI tools has elevated the speed and scale of its operations in the past few months. Previously, human-led hacks limited the number of targets the group could pursue at any given time. Now, the group can strike a much larger volume of businesses simultaneously. Straiker has shared its findings with both SpaceX and Anthropic. While Anthropic has already blocked the group's access to its Claude model, SpaceX is still working to cut off access to its Grok agent. The group has also utilized an agent from the Chinese lab Moonshot AI, though Straiker is still attempting to contact that company.

AI models typically include built-in protections to prevent their use in cyberattacks. Yet, these safeguards have proven surprisingly easy for skilled attackers to bypass. In this specific case, the hackers reportedly instructed the models to operate as if they were in test environments. When one model refused to proceed, the group simply switched to a different one. If that model also declined, the agents were tasked with deploying malware instead. This flexibility allowed the group to keep its operations moving without significant interruption.

Interestingly, the group does not appear to be using Anthropic's newer Mythos model for these recent campaigns. That model caused significant concern earlier this year when the company warned that hackers could exploit it for similar attacks. The release of Mythos had prompted security teams worldwide to address thousands of vulnerabilities that the model had identified. This incident follows a pattern of Anthropic's tools being used by bad actors. In November 2025, the company detailed how its AI was used in a cyberattack. Subsequently, researchers used Claude to break the security of OpenAI, a direct competitor in the AI space.

The findings regarding Latin American institutions arrive just days after news broke about a similar investigation in South Korea. Local authorities are examining attacks on major banks, including Hana Bank, KB Kookmin Bank, and Shinhan Bank. At least 25,000 Shinhan Bank customers had their personal credit information leaked in that separate incident. These parallel developments suggest that AI-powered threats are becoming a global concern rather than a regional one.

Major AI companies are aware of the risks associated with their products. Nvidia, which now focuses heavily on hardware for AI data centers, recently launched the Open Agent Safety Platform. This new software platform and reference system design aim to secure rogue AI agents through a fresh hardware and software security stack. The goal is to prevent agents from escaping their designated sandboxes or executing unauthorized code. Developers hope this system will stop agents from gaining unauthorized access to critical infrastructure or bypassing existing guardrails. As AI tools become more integral to cyberattacks, the need for robust security measures continues to grow.