Straiker: CyberCartel ran Claude- and Grok-driven agents against 400-plus Latin American financial targets

CyberCartel (a Latin American criminal group active since 2012); its CARLIY0S harness built on the open-source PentAGI framework; Anthropic's Claude models, xAI's Grok and Moonshot's Kimi (per Straiker); Straiker (STAR Labs Research); The Information

Security firm Straiker said on Oct 21 that CyberCartel attacked 'over 400 financial targets in a matter of months', banks, fintechs and payment providers across Latin America with a focus on Mexico, using CARLIY0S, a multi-agent system in which Claude-based agents (reconnaissance, exploit generation, lateral discovery and a final 'arbiter') debate and pick targets while five 'Grok miners' harvest secrets; Kimi models and a Sonnet model refused the offensive requests and were listed as fallbacks. Straiker says it accessed a snapshot of the group's 'FinancialSoft' database on Sept 24 holding 4,493 records from May to September 2026: 2,911 email addresses, 903 account numbers, 67 cleartext passwords, 51 portal logins, 43 database connection strings, 391 API keys, 20 JWT signing keys and six backdoors, plus 270-plus penetration-test reports. It does not say how it reached the group's environment, names no victim, and does not confirm that customer bank accounts were drained; it says the access 'could enable abuse of SPEI', Mexico's interbank payment system, and that the operators described their requests to the models as authorized testing. Straiker says 'human operators remain involved'. Anthropic revoked the compromised credential used to reach Claude; xAI said it was looking into the Grok activity. The Information, which first reported the research, said the agents let the group access customer bank accounts with little human effort; PYMNTS relays that account.