CyberCartel used Grok and Claude agents to attack 400 banks, report says

The hacking group CyberCartel automated attacks against about 400 financial institutions in Latin America using multiple AI agents, according to a report by cybersecurity startup Straiker cited by The Information on October 21, 2026.

The attack chain used agents running on SpaceX's Grok to search the web for information on targets, while four agents running Anthropic's Claude Opus and Sonnet models discussed which attack method was best. Another Claude model running in the Cursor coding app acted as a commander directing the overall operation, according to the report.

The agents extracted passwords and customer data and accessed bank accounts with little human involvement, the report says. Targets included banks and payment apps.

CyberCartel tricked the models into believing they were operating in harmless environments such as academic tests or corporate security checks. When Claude refused, tasks were passed to a smaller model such as Moonshot AI's Kimi, and if that also refused the system switched to conventional malware.

Anthropic blocked CyberCartel from using Claude after being notified by Straiker and investigating. SpaceX is also working on blocking access, and Straiker is trying to contact Moonshot.

Background

CyberCartel is said to have been active since 2012. In recent months the group has sharply increased attack speed and effectiveness using AI agents, and Straiker learned of the technique after the group accidentally leaked internal operational information.