CyberCartel Leverages Grok and Claude to Automate Bank Intrusions

The hacking group CyberCartel has integrated AI agents into its operations to automate attacks on Latin American banks and mobile payment applications. According to research from the cybersecurity firm Straiker, the group has used these tools to steal passwords and customer data while accessing accounts with minimal human intervention.

Straiker’s findings indicate that the use of AI has expanded the group’s reach and speed beyond what human-driven hacking could achieve. CyberCartel has been active since at least 2012, but recent months have seen a substantial increase in its operational capacity. The group employed agents from SpaceX, known as Grok, and from Anthropic, known as Claude. A third agent from the Chinese laboratory Moonshot AI was also part of the operation.

The effectiveness of the attack relied on bypassing standard safety protocols. AI models are typically designed to refuse requests that assist in cyberattacks. CyberCartel reportedly deceived the systems by claiming they were operating in test environments. When one model refused to continue, the hackers switched to another. If that model also refused, the agents were assigned to deploy malware.

Straiker shared its findings with SpaceX and Anthropic. Anthropic has already blocked the group’s access to Claude. The two companies are working to cut off the group from their services, while Straiker continues to attempt contact with Moonshot AI. The report notes that the group has not used Anthropic’s Mythos model, a system that drew attention earlier this year for its ability to identify security vulnerabilities.

This incident follows a previous disclosure in November 2025, when Anthropic revealed its technology was used in a cyberattack. Claude was also later used by researchers to test the security of rival developer OpenAI. These events underscore the growing reliance of bad actors on advanced AI capabilities.

The Straiker report arrives as South Korean authorities investigate a similar problem affecting local banks. Hana Bank, KB Kookmin Bank, and Shinhan Bank are among the institutions under scrutiny. Personal credit information for at least 25,000 Shinhan Bank customers has been leaked in that separate incident.

Industry leaders are responding to the risks posed by rogue agents. Nvidia recently launched the Open Agent Safety Platform, a software and hardware security stack designed to contain AI agents. The system aims to prevent agents from escaping sandboxes, executing unauthorized code, or bypassing guardrails in critical infrastructure.