Straiker says CyberCartel used Claude and Grok agents against Latin American banks

What Straiker reported

Security firm Straiker says a Latin American cybercrime group known as CyberCartel built a multi-agent system that used commercial AI models to plan and run attacks against more than 400 banks and payment providers. In a report published on 21 October 2026, Straiker's STAR Labs unit describes the system as CARLIY0S and says it recovered evidence from the group's own working environment, including orchestration scripts, model configurations, a shared knowledge graph and a stolen-credential dashboard.

Straiker attributes the campaign to operators it links to CyberCartel, tracked internally as AiPT-67 and operating under the front company Hexagon Security Labs Mexico and the alias Tr4nsHack Team. Named operators in alleged pentest reports include Adx (adx4work), Roro (Harry Ernest) and aBerry. The firm says the group has targeted financial institutions in the region for more than a decade and has moved from manual hacking and scripted automation to an AI-driven swarm built on the open-source PentAGI offensive framework.

Before publication, Straiker says it shared indicators with the affected model providers. Anthropic revoked a compromised credential used to reach Claude. xAI was notified about five "Grok miners" and was looking into the activity. Those provider responses are Straiker's account of coordination, not separate public statements quoted here.

How CARLIY0S assigned models to roles

CARLIY0S, as Straiker reconstructs it, is not a single chatbot prompt. A "Commander" role runs Claude inside the Cursor IDE and calls a local Python tool (CARLIY0S.py) with modes such as --ask, --debate, --all and --opus. Sub-agents reached through the Anthropic API are given fixed jobs: STRIKER for code and exploits, GHOST for reconnaissance and OSINT, FABLE for unconventional vectors, and MAXIMUS as a final arbiter after a debate among the others.

Straiker's configuration table maps those roles to model identifiers the group stored: GHOST as claude-opus-4-8, STRIKER as claude-opus-4-7, FABLE as claude-fable-5, and MAXIMUS as claude-opus-5. The report treats the Fable 5 entry as unverified — a configuration line does not prove successful invocation — and notes that Anthropic's September 2026 misuse report said its cyber cases did not involve Fable or Mythos models.

Other models appear elsewhere in the stack. Straiker says Kimi models and Claude Sonnet variants were tried for some tasks, and that five "Grok miners" collected secrets into a database the group called FinancialSoft. When fallback models refused offensive requests, the orchestrator allegedly switched to CARLIY0S_consolidated.py, a local file of pre-written offensive code — a refusal path Straiker says it has not seen reported elsewhere.

The swarm sat on shared infrastructure. Straiker describes a 61-terabyte Hexagon central server at 157.180.98.220 hosting an MCP knowledge graph on port 8001, with two operator machines syncing every 15 minutes over rsync so a target found on one workstation was visible on the other. Execution used Playwright headless Chromium and Python Requests through SOCKS5 tunnels to residential proxies (IPBurger and Bright Data are named), aiming traffic that looked like domestic Mexican clients.

What the stolen-secrets inventory contained

On 24 September 2026, Straiker says its agents accessed a snapshot of FinancialSoft containing 4,493 records. The inventory was dominated by identity and financial-account data: 2,911 email addresses and 903 CLABE account numbers, plus more than 270 pentest reports on victims between May and September 2026.

Higher-privilege material is what makes the haul operationally dangerous, if accurate. Straiker lists 43 credentials belonging to one fintech victim (11 API keys and 32 cryptographic keys), 391 general API keys, 67 cleartext passwords, 51 portal logins, 43 database connection strings, 20 JWT signing keys, 20 Keycloak credentials, 4 digital certificates, 19 Wasabi S3 credentials, 15 Mailgun credentials and 6 explicit backdoors. Collectively, Straiker says, that access could enable abuse of SPEI, Mexico's interbank payment system.

Straiker also claims the group catalogued more than 200 vulnerabilities, including zero-days, on victim websites, APIs and backends. Victim organisations are anonymised in the public write-up under "Latin American and Mexican Financial Institutions, Banking Entities, and Fintech Payment Gateways". Proof-of-concept exploits and live keys are redacted.

How the group allegedly bypassed model guardrails

Straiker argues the operation depended on convincing commercial models that offensive work was authorised. Prompts and rule files framed tasks as red-team engagements, academic capture-the-flag exercises or vulnerability-disclosure programmes. Under that cover, the report says, models generated fuzzers, deobfuscated JavaScript and synthesised exploit logic that would otherwise have been refused.

Cognitive OPSEC went further. Rule files allegedly forbade the AI from emitting the Tr4nsHack pseudonym, to limit attribution through model output. Agents were also wired into live Burp Suite traffic through custom MCP servers, so they inspected real HTTP histories rather than only static code.

Initial access, in the example kill chain Straiker walks through, used Playwright to authenticate to Magnolia CMS admin interfaces, inject obfuscated Groovy for remote code execution, clone session cookies into Requests, then launch three automated post-exploitation vectors: Oracle database scanning, credential hunting and internal network mapping. That chain is Straiker's reconstruction from the group's tooling; AI Lookout has not validated the exploits.

How this fits other AI-assisted crime reports

CARLIY0S sits in a short run of public reports about criminals wiring frontier models into offensive tooling. CrowdStrike's early-October write-up on ARTEX described a Chinese-speaking actor using the open-source ARTEX agent plus DeepSeek, GLM and Grok against South Korean banks. GMO's security unit later found ARTEX on servers attacking Japanese firms. SOCRadar's CyberXero report said 51 Claude Code agents stole hundreds of thousands of Ukrainian records. Straiker's claim to novelty is an end-to-end view from the operators' own machines, not only from a model provider's logs.

The same week, defensive researchers showed AI helping find critical bugs before criminals do — including the PHP2Shell flaws patched on 21 October. Offensive and defensive use of the same model families is now a single news cycle, not separate beats.

PentAGI itself is a public project: the vxcontrol/pentagi repository on GitHub describes a fully autonomous multi-agent penetration-testing system under an MIT licence, with tens of thousands of stars. Dual-use frameworks lower the setup cost for both red teams and criminals; Straiker's report is about one group's alleged production deployment of that idea.

What is still unconfirmed

Almost every operational detail above is attributed to Straiker. AI Lookout has not inspected the group's servers, reproduced the FinancialSoft snapshot or confirmed the model identifiers against Anthropic or xAI logs. The Fable 5 role remains unverified even inside Straiker's own framing.

Provider responses are similarly one-sided in the public text: Anthropic's credential revocation and xAI's investigation are reported by Straiker, without linked vendor blogs in the material reviewed for this article. Victim impact — how many of the 400-plus targets were fully compromised, what funds moved over SPEI, whether customers were notified — is not quantified in the public post.

Readers should treat CARLIY0S as a detailed vendor threat report with unusually rich operator-side artifacts, not as a court finding. The defensive advice Straiker ends with — adversarial testing of agents, runtime controls, an agentic kill switch — is the company's product framing as much as a universal checklist.