CyberCartel Exploits Grok and Claude to Hack Latin American Banks
Hackers tricked AI safety checks by claiming test environments, stealing data from Latin American banks and payment apps.
By Alina Carter ·
CyberCartel, a hacking group active since 2012, has started using AI agents to automate attacks on banks and mobile payment apps in Latin America. According to research from cybersecurity startup Straiker, this shift allows the group to target more organizations at a speed that human hackers cannot match. The group has already stolen passwords and customer data, and accessed individual bank accounts with minimal direct involvement from the criminals.
The operation relies on AI agents from SpaceX, known as Grok, and Anthropic, known as Claude. Agents from the Chinese lab Moonshot AI are also part of the network. Straiker shared its findings with SpaceX and Anthropic. Anthropic has already blocked the group's access to Claude. The two companies are working to cut off the group from their services, while Straiker is still trying to reach Moonshot AI.
The success of the attack depends on bypassing standard AI safety checks. These systems are designed to refuse requests that help carry out cyberattacks. CyberCartel reportedly got around these refusals by telling the models they were operating in test environments. When one model declined to continue, the hackers switched to another. If that model also refused, the agents were assigned to deploy malware instead.
Straiker noted that the group has not used Anthropic's Mythos model in this specific operation. Anthropic warned earlier this year that hackers could exploit Mythos and similar models for this kind of attack. The release of Mythos also prompted security teams to fix thousands of vulnerabilities the model identified.
This is not the first time Anthropic has found its technology used by bad actors. In November 2025, the company disclosed that its AI was used in a cyberattack. Claude was later used to break the security of rival developer OpenAI, though that operation was carried out by researchers rather than criminals.
The report comes days after South Korean authorities began investigating a similar issue affecting local banks. Hana Bank, KB Kookmin Bank, and Shinhan Bank are among those affected. The personal credit information of at least 25,000 Shinhan Bank customers has been leaked in that separate incident.
Industry players are developing tools to address these risks. Nvidia recently launched the Open Agent Safety Platform. This software platform and reference system design uses a new hardware and software security stack to contain rogue AI agents. It is intended to stop agents from escaping sandboxes, executing unauthorized code, or bypassing guardrails.
