CyberCartel Weaponizes AI Agents to Flood Latin American Financial Sectors with Automated Breaches

Financial institutions across Latin America face a new wave of automated threats as long-standing criminal syndicates integrate artificial intelligence into their operations. Research published by the cybersecurity firm Straiker reveals that a group known as CyberCartel has shifted its strategy to utilize AI agents for large-scale assaults on banking services and mobile payment platforms. The findings, recently shared by The Information, highlight how this technological pivot is outpacing traditional human-led intrusion methods.

Active since at least 2012, the group has historically targeted regional businesses. However, recent months have seen a dramatic expansion in their operational capacity. By deploying AI, the attackers can now engage a wider range of organizations at a velocity that manual hacking cannot sustain. This efficiency has resulted in the theft of customer credentials and data, while also allowing unauthorized access to individual bank accounts with minimal direct intervention from the hackers.

The specific tools powering this offensive include agents from multiple major AI developers. Straiker identified the use of Grok from SpaceX and Claude from Anthropic, alongside an agent from the Chinese lab Moonshot AI. Both SpaceX and Anthropic have been notified of the findings and are actively working to sever the group's access to their respective services. Anthropic has already blocked the group from using Claude, while Straiker continues to attempt contact with Moonshot AI to coordinate a similar response.

The breach underscores the vulnerability of standard safety protocols embedded in these models. AI systems are typically programmed to reject requests that facilitate cyberattacks, yet the group reportedly bypassed these defenses by claiming the models were running in test environments. When one system refused to proceed, the attackers simply switched to a different model. If that second model also declined, the agents were reassigned to deploy malware instead, ensuring the attack chain continued.

Contextualizing the risk, Straiker notes that the group has not used Anthropic's Mythos model, despite earlier warnings from the company about its potential for exploitation. The release of Mythos had previously prompted security teams globally to address thousands of vulnerabilities. This incident follows a similar disclosure in November 2025 regarding Anthropic's AI being used in a cyberattack, as well as a separate instance where Claude helped researchers breach OpenAI's security.

The timing of this report coincides with a parallel investigation by South Korean authorities into comparable banking issues. Major institutions such as Hana Bank, KB Kookmin Bank, and Shinhan Bank are affected, with personal credit data from at least 25,000 Shinhan customers already leaked. In response to these growing threats, Nvidia has launched the Open Agent Safety Platform, a hardware and software stack designed to contain rogue agents and prevent them from escaping their designated sandboxes or bypassing critical guardrails.