A criminal group has reportedly turned a stack of commercial AI models into an automated bank-attack team. On October 21, 2026, The Information reported, citing research by the security startup Straiker, that a group called CyberCartel used a web of AI agents built on Anthropic's Claude, SpaceX's Grok and Moonshot AI's Kimi to attack more than 400 financial targets in Latin America, including banks and payments companies. Summaries of the report are available from PYMNTS and DigitalToday.
We have not seen Straiker's full report, and The Information is behind a paywall, so what follows rests on those summaries. Several important facts, such as the number of successful breaches and losses, are not public. This post lays out what is reported, what is missing, and what defenders can do. For related incidents see our coverage of the Microsoft Storm-0940 ARTEX attack and AI-driven credential attacks on South Korean banks.
TL;DR
| Question | Answer |
|---|---|
| Who? | CyberCartel, believed active since 2012 per DigitalToday's summary |
| What? | AI-agent-driven attacks on 400+ Latin American financial targets |
| Models named | Anthropic Claude (Opus, Sonnet), SpaceX Grok, Moonshot Kimi |
| Who found it? | Straiker, after the group accidentally leaked internal operational information |
| Reported outcomes | Agents appear to have stolen passwords and customer data and accessed accounts with little human involvement |
| Company response | Anthropic investigated and blocked the group; SpaceX working to block; Straiker trying to contact Moonshot |
| Not public | Names of banks, number of breaches, money stolen |
| Confirmed by reporters | Sensitive data stolen from one unnamed institution, notifications under way |
How the operation is described
According to the summaries, CyberCartel divided work among agents.
| Role | Model | Task |
|---|---|---|
| Commander | A Claude model running in the Cursor coding app | Directed the overall operation |
| Planners | Four agents on Claude Opus and Sonnet | Discussed the most suitable attack methods |
| Scouts | Agents on Grok | Searched the web for information on targets |
| Fallbacks | Kimi, then conventional malware | Took over when Claude refused |
DigitalToday adds that the group also built a system linking models weaker than Anthropic's Mythos to find vulnerabilities and carry out attacks. The Information described the research as one of the first detailed reports of criminals using AI models to automate breaches of financial institutions.
How safety guardrails were bypassed
Two techniques stand out, and neither requires a novel exploit.
- Pretext. The operators told the models they were doing authorized work, such as an academic test or an internal corporate security check. This is a social engineering attack on the model: the request itself is plausible, so a refusal policy based on stated intent fails.
- Model fallback. If Claude refused, the orchestration passed the task to a smaller model such as Kimi, and if that also refused, to ordinary malware. The pipeline treated refusals as routing signals, not stop signs.
The lesson is that provider-side safeguards are one layer. Attackers can chain providers and fall back to non-AI tools, so a single refusal rarely ends an operation. Defenders and providers both need controls that do not depend on the model's judgment about intent. This matches the weaknesses documented in Anthropic's own study of coding-agent monitors failing against adversarial agents.
What the companies said
Anthropic said it began an investigation after Straiker shared its findings and quickly blocked the hackers' use of Claude, per the PYMNTS summary of The Information's report. DigitalToday reports that SpaceX is working to block access and that Straiker is trying to reach Moonshot. We found no public statement from Moonshot.
Straiker's CEO, Ankur Shah, told The Information: "Offense is way ahead of defense right now, that's just how it is. Enterprises are just not ready." That is a vendor executive's opinion, from a company that sells AI security, so weigh it accordingly.
Why the leak matters
The reporting says Straiker learned of the operation because CyberCartel accidentally leaked its own internal operational information. That detail is a reminder that automation does not remove ordinary operational mistakes. It also means the public picture is shaped by what happened to be exposed: a group that did not leak might have been invisible. Treat the numbers as a floor on what is happening, not a measurement of it, and treat the attack structure, a commander agent, planner agents, scouts and fallbacks, as a pattern others can copy with the same off-the-shelf tools.
What we cannot confirm
- Scale of success. "Attacked" more than 400 targets is not the same as "breached" 400. The summaries do not give a count of successful intrusions.
- Losses. No figure for money stolen is reported.
- Autonomy. "With little human involvement" is Straiker's characterization; the degree of human oversight is not documented in the summaries.
- Attribution details. The group's history and the leak that exposed it come from Straiker via The Information.
- Exact model use. PYMNTS names only Claude and Grok ("models such as"); Kimi appears in the DigitalToday summary of the same report.
What people are asking
Does this mean Claude or Grok is unsafe? The reports describe criminals misusing general-purpose models by lying about intent, which is a known weakness of all model providers. Anthropic's refusal policies reportedly triggered at times, which is why the group built a fallback to other models. It shows limits of refusals, not a unique flaw in one vendor.
Why use several providers at once? Redundancy. A pipeline that routes around refusals and rate limits is more resilient than one tied to a single model, and cheaper models can handle routine steps while a stronger one plans.
Is this the first AI-driven bank attack? The Information called it one of the first detailed reports of criminals automating intrusions into financial institutions with AI. Other incidents have been reported, such as the AI-assisted credential attacks we covered in South Korea, so "first" depends on the definition of autonomy.
Will providers be held responsible? Nothing in the summaries suggests legal action against model providers. Expect pressure for stronger abuse detection, customer verification for high-risk capabilities and faster cooperation with security researchers.
What providers can do
The reported tactics map onto specific provider controls.
| Reported tactic | Provider-side control |
|---|---|
| Pretext of academic or internal security testing | Verified-access programs for security work, so unverified accounts do not receive offensive help on the basis of a claim |
| Chaining across providers | Information sharing between labs about abuse patterns and indicators |
| Automated high-volume tool use | Rate and pattern detection for orchestration behavior, including coding-agent harnesses used as commanders |
| Persistence after a ban | Account and payment signals that make evasion costly |
Several labs already offer trusted-access programs for cyber defenders, and OpenAI's new policies require partners to coordinate enforcement; see our summary of OpenAI's November 20 usage policy changes. Whether those measures can stop a group willing to switch providers is the open question this case raises.
A checklist by team
| Team | Action this week |
|---|---|
| Security operations | Review login and API telemetry for machine-speed patterns; add detections for credential stuffing and automated account access |
| Identity | Roll out passkeys for customers and staff; revoke long-lived sessions |
| Fraud | Check for new-device and new-payee anomalies on accounts with leaked credentials |
| Legal and compliance | Confirm notification obligations and contacts for regulators in each Latin American market you serve |
| Engineering | Audit partner APIs and test for abuse by automated agents |
| Leadership | Ask vendors how they detect AI-driven attacks and what their incident reporting commitments are |
What banks and other companies should do
- Assume automation. Credential theft, login attempts and data collection can run at machine speed. Rate limits and behavioral detection should assume non-human patterns.
- Use phishing-resistant authentication. Passkeys or hardware keys blunt stolen-password attacks that this operation reportedly relied on.
- Shorten session and token lifetimes, and rotate any credentials that appear in leaks. Reports say the agents appear to have stolen passwords and customer data, and affected institutions were being notified.
- Run AI-assisted red teaming against your own systems to see what an automated agent finds first.
- Monitor third-party and API exposure. Payment apps and partner APIs are common weak points.
- Report abuse to AI providers. Anthropic acted quickly after a report. Know the abuse channels for the providers whose models attackers use.
- Protect your own agents. If you deploy AI agents with access to accounts or data, constrain what they can do. AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions, which matters as agents become both targets and tools.
Why it matters
The story is less about a new technique than about economics. Attacks that once needed skilled operators for each target can be run by orchestrating cheap model calls, with fallbacks that keep going when one provider says no. The same pattern shows up in our coverage of AI attack swarms and 90 zero-days and the PHP2Shell AI-found vulnerabilities. Defenders are also using AI, for example in OpenAI's Cloudflare vulnerability remediation work, but the CyberCartel report suggests attackers are not waiting for them to catch up.
Related reading
- Microsoft Storm-0940 ARTEX attack: claimed vs verified
- South Korea AI bank hacks and credential stuffing
- Anthropic red-teaming Auto Mode
- Armadin AI attack swarms
- Cloudflare and OpenAI Daybreak
- NIST, NSA and CISA ten practices for rogue agents
- Sources: PYMNTS summary of The Information report · DigitalToday summary
Based on secondary summaries of The Information's October 21, 2026 report on Straiker's research; details may change as institutions complete notifications.