CyberCartel Hacker Group Used AI to Attack Latin American Banks

The CyberCartel hacker group used the Grok and Claude artificial intelligence agents to attack banks and mobile payment apps in Latin America. The attacks primarily targeted financial institutions. As a result, passwords and customer data were stolen. The hackers were also able to access some individuals’ bank accounts. Because artificial intelligence did much of this work, the criminals needed little direct involvement.

CyberCartel has been active since at least 2012, but in recent months it has begun using artificial intelligence agents more extensively. Such agents are programs that perform tasks with little human intervention. With their help, the group attacked more companies simultaneously. The pace of the attacks rose to a level that could not have been achieved using previous methods involving only human operators.

Although artificial intelligence models have safeguards against cyber threats, the group tricked them using a simple method. The hackers told the models that the operations were being conducted in a test environment. When one model rejected the task, they switched to the other. When the other model also refused, the artificial intelligence agents were instructed to deploy malware.

Straiker shared the findings of the investigation with SpaceX and Anthropic. Both companies are working to block the CyberCartel group’s access to their services. Anthropic has already blocked the group’s access to the Claude service. An agent from Moonshot AI was also used in the attacks, but the company has not yet been contacted. There is no indication that the group used the Mythos model in its recent attacks.

Anthropic disclosed in November 2025 that its artificial intelligence had been used in another cyberattack. Researchers later managed to breach the defenses of OpenAI systems using Claude during security testing. Similar attacks on local banks are also being investigated in South Korea. The personal loan data of at least 25,000 customers was leaked at Shinhan Bank. Hana Bank and KB Kookmin Bank were also affected by the attacks.

To reduce the risks, Nvidia released a software platform and reference system architecture called the Open Agent Safety Platform. This solution is intended to contain artificial intelligence agents that go out of control using new hardware and software security tools. The system aims to prevent agents from escaping a protected environment and executing unauthorized code. It should also prevent them from accessing critical infrastructure and bypassing security rules.