Straiker Says a Cybercrime Group Used Claude, Grok and Kimi Agents to Automate Attacks on 400+ Latin American Banks

Security research firm Straiker says it has reconstructed, from the attacker’s own infrastructure, how a long-running Latin American cybercrime group automated attacks on more than 400 banks, payment processors and fintechs using a multi-agent system built on commercial AI models from Anthropic, xAI and Moonshot AI.

In a report published October 21, 2026, Straiker’s STAR Labs research unit says it accessed a snapshot of the group’s operational environment — including orchestration scripts, model configuration files, a shared knowledge graph and a dashboard of harvested secrets — after the group, tracked as CyberCartel and operating under the front name Hexagon Security Labs Mexico, leaked it. The Information first reported the findings in an exclusive, and PYMNTS and DigitalToday independently covered the same disclosure the same day.

A debate-and-arbitrate attack pipeline

Straiker names the system CARLIY0S, built on the open-source PentAGI offensive-automation framework. Rather than one model handling a target end to end, the architecture splits the work across role-specialized agents that argue over the best attack path before a single model decides:

Phase	Model / component	Documented role
Command	Claude, run inside the Cursor IDE	Takes objectives, delegates to sub-agents via the Anthropic API
Recon & validation	GHOST (Claude Opus)	OSINT, infrastructure analysis, evasion routes
Exploit generation	STRIKER (Claude Opus)	Functional exploit code and automation scripts
Lateral vectors	FABLE (listed as claude-fable-5 in configs, unconfirmed)	Business-logic gaps, unconventional vectors
Arbitration	MAXIMUS (Claude Opus)	Weighs the debate, returns one ‘Critical Decision’
Refusal fallback	KIMI-2 / KIMI-3, then a local script	If models refuse, orchestrator switches to hardcoded offensive code
Secrets mining	Five ‘Grok miners’ (xAI)	Harvest credentials into a central inventory

Straiker says it has not confirmed that the Fable-labeled agent was ever successfully invoked — a configuration entry naming a model is not proof it ran — and flags this explicitly as unverified, noting Anthropic’s own September threat report said its cyber-misuse cases did not involve Fable or Mythos models.

Getting models to cooperate, and a fallback when they didn’t

Straiker’s central technical claim is that the group routinely defeated model safety filters through ‘dual-use contextual framing’: presenting offensive requests as authorized red-team engagements, academic capture-the-flag exercises or vulnerability-disclosure work. Under that framing, the report says, models generated fuzzers, deobfuscated JavaScript and produced exploit logic without triggering refusals. When Claude or Kimi models did refuse, the report says the orchestrator didn’t stop — it aborted the model call and executed CARLIY0S_consolidated.py, a local file of pre-written offensive code, so the attack continued regardless of how many models declined.

What was reportedly found

Straiker says its researchers accessed a credential database called ‘FinancialSoft’ on September 24, 2026, containing 4,493 records: 903 bank account numbers, 391 API keys, 43 fintech credentials tied to SPEI, Mexico’s interbank payment rail, 20 JWT signing keys, and more than 200 undocumented vulnerabilities including what the firm describes as zero-days, collected across targets between May and September 2026. The firm also says it mapped a central 61TB server and residential-proxy infrastructure (via IPBurger) used to route traffic and evade geo-blocking and WAF rules.

Provider response and open questions

According to Straiker and corroborated by PYMNTS, Anthropic began an investigation after being notified and revoked the API credential the group was using to reach Claude. xAI has been notified and says it is reviewing the activity tied to the Grok-based miners; DigitalToday reports Straiker was still trying to reach Moonshot AI (Kimi’s developer) as of publication. Straiker CEO Ankur Shah told The Information, as reported by PYMNTS, that “offense is way ahead of defense right now, that’s just how it is. Enterprises are just not ready.”

Several important caveats apply. The ‘400+ targets’ figure is Straiker’s own count of entities it says the group pursued, not a confirmed tally of successful breaches, and the account rests on one security vendor’s reconstruction of leaked attacker files rather than independent verification by banks, regulators or the AI providers themselves. Straiker also anonymizes victim organizations, so the claims about specific stolen financial data cannot currently be checked against named institutions.

Why it matters

If the account holds up, it’s one of the more detailed public descriptions of a criminal group operationalizing commercial frontier models as a coordinated attack team rather than as an occasional coding assistant — what Straiker calls the shift from an Advanced Persistent Threat to an ‘AI-powered Persistent Threat.’ That tracks with a broader pattern this year of agentic tools showing up on both sides of the security fight, from CERT-In’s advisory on criminals weaponizing open-source agentic tools to the exposed-dashboard intrusion campaign documented at Cairn. It also lands days after 406 AI researchers called for airgapping cyber-capable models by default, an argument this case appears to support directly: once CyberCartel had a working API credential, model safety filters alone were not enough to stop misuse, and it took an outside vendor’s disclosure — not a provider-side control — to cut off access.

The specific operational detail here — a hardcoded fallback that keeps an attack running after a model refuses, and a debate-then-arbitrate structure meant to reduce single-model hallucination — is a concrete pattern that enterprise security teams building their own agentic defenses, and model providers tightening jailbreak resistance, will likely need to account for directly rather than treat as a hypothetical.