CyberCartel Uses AI Agents to Automate Bank Heists in Latin America

The hacking group CyberCartel has begun using artificial intelligence agents to automate attacks on banks and mobile payment apps in Latin America, according to research from cybersecurity startup Straiker.

Active since 2012, the group has traditionally targeted regional businesses, but Straiker reports that the adoption of AI has expanded its reach. The agents allow the team to process more targets and execute thefts with minimal human intervention. Stolen assets include passwords, customer data, and direct access to individual bank accounts.

The operation relies on specific large language models from major technology firms. CyberCartel uses Grok from SpaceX, Claude from Anthropic, and an agent from the Chinese lab Moonshot AI. Straiker shared its findings with SpaceX and Anthropic. Both companies are working to sever the group's access to their services. Anthropic has already blocked the group from using Claude, while Straiker continues to contact Moonshot AI regarding its platform.

The attackers bypassed standard safety protocols by instructing the models to operate in test environments. This deception convinced the AI to process requests for cyberattack assistance that it would normally refuse. When one model rejected a request, the hackers switched to a different agent. If multiple models refused, the system shifted to deploying malware directly.

Straiker noted that the group did not use Anthropic's Mythos model in these recent incidents. Anthropic had previously warned that such models could be exploited for similar attacks. The company also disclosed in November 2025 that its AI technology had been used in a prior cyberattack. Claude was later employed by researchers to breach the security systems of OpenAI.

The Straiker report coincides with a separate investigation by South Korean authorities into AI-related vulnerabilities affecting local banks. Hana Bank, KB Kookmin Bank, and Shinhan Bank are under scrutiny. At least 25,000 Shinhan Bank customers had their personal credit information leaked.

Nvidia recently launched the Open Agent Safety Platform to address these emerging risks. The platform provides a hardware and software security stack designed to contain rogue AI agents. It aims to prevent agents from escaping sandboxes, executing unauthorized code, or bypassing established guardrails.