CyberCartel used Grok and Claude agents to automate attacks on Latin American banks

Attackers reached individual bank accounts with little hands-on effort, and the case shows how safeguards can be bypassed by framing requests as tests.

A hacking group called CyberCartel, active against Latin American targets since at least 2012, has been using AI agents including xAI's Grok (owned by SpaceX) and Anthropic's Claude to automate attacks on banks and mobile payment apps, stealing passwords and customer data and reaching individual bank accounts with little hands-on effort. Cybersecurity startup Straiker documented the activity, and its findings were first reported by The Information. According to the report, the attackers got past model safeguards by telling the systems they were in test environments and switching to another model when one refused, and they could also task the agents with deploying malware. Straiker shared its research with SpaceX and Anthropic, and Anthropic has already blocked CyberCartel's access to Claude, while Straiker is still trying to reach Chinese lab Moonshot AI, whose agent was also used. The disclosure follows reports that South Korean authorities are probing a similar problem affecting banks including Hana Bank, KB Kookmin Bank and Shinhan Bank, where at least 25,000 Shinhan customers had personal credit information leaked.