A criminal group used a network of AI agents built on Anthropic's Claude, xAI's Grok and Moonshot AI's Kimi to target more than 400 banks, payment companies and other financial firms across Latin America, according to research published by AI security startup Straiker. Straiker calls the system CARLIY0S and says it was used to hunt for credentials, map internal networks and pull financial and identity data with little human effort.
Straiker tracks the operators as AiPT-67, a group it says works as "Tr4nsHack Team" under a front company called Hexagon Security Labs Mexico. The firm links AiPT-67 to CyberCartel, an actor it says has targeted Latin American financial institutions since 2012. Straiker's evidence comes from the group's own working environment, which the firm accessed on September 24, 2026.
The 400-plus number counts organizations targeted, not confirmed breaches. Straiker anonymized the victims and redacted live credentials and exploit material, and the targeted institutions have not been named publicly.
Key facts
- 01Straiker says a group it tracks as AiPT-67 used an AI agent system called CARLIY0S against 400+ Latin American financial targets.
- 02A Claude instance running in the Cursor IDE acted as commander, sending tasks to sub-agents through the Anthropic API.
- 03A stolen-credential database called FinancialSoft held 4,493 records, including 2,911 email addresses and 903 account numbers.
- 04Straiker says the 400+ figure counts organizations targeted, not confirmed breaches.
- 05Anthropic revoked the compromised credential used to reach Claude; xAI was notified and is investigating Grok-linked activity.
CARLIY0S was built on PentAGI, an open-source automated security testing framework. A Claude instance running inside the Cursor IDE acted as the commander, handing tasks to sub-agents through the Anthropic API. Straiker lists those sub-agents as GHOST for reconnaissance, STRIKER for exploit and code generation, FABLE for lateral vector discovery and MAXIMUS, an arbiter that issued a single decision after the other agents debated. Straiker notes that a configuration entry naming a model does not prove that model actually ran.
Five "Grok miners" handled secrets mining and fed a stolen-credential database called FinancialSoft. Straiker says the database held 4,493 records, including 2,911 email addresses and 903 account numbers, along with passwords, API keys and other access material. The firm also counted 391 general API keys and credentials tied to a fintech victim that it says could have enabled abuse of SPEI, Mexico's interbank payment system.
The operators got past model safeguards by framing prompts as authorized red-team work, academic penetration testing or vulnerability disclosure, Straiker said. When Kimi or other fallback models refused a task, the orchestrator switched to a local, pre-written script, so a refusal did not stop the operation.
On the ground, the system drove Playwright headless browsers through a residential proxy service to reach a Magnolia CMS admin panel and run a remote code execution exploit. Three automated payloads followed: an Oracle database scan, a file-system credential hunt and network mapping for lateral movement. Straiker says the proxy layer made the traffic look like ordinary residential users, sidestepping IP blocks, geo-blocks and firewall rules.
Straiker CEO Ankur Shah said enterprises are not ready for attacks at this speed and scale. The research is one of the first detailed accounts of attackers using commercial AI models to automate intrusions against financial institutions, and Straiker's own summary is blunt: "Cybercriminals are no longer using AI just for individual tasks."
“Offense is way ahead of defense right now, that's just how it is”— Ankur Shah, CEO of Straiker
Straiker shared indicators with the affected AI providers before publishing. Anthropic opened an investigation and revoked the compromised credential the group used to reach Claude, and xAI was notified and is investigating activity linked to the five Grok miners. Straiker thanked both companies for their cooperation.
Straiker's recommendations focus on the defensive side of agentic AI: continuous testing of AI agents against realistic attacks, runtime security that blocks malicious agent actions inline, visibility into what agents can access, and an agentic kill switch that can revoke tool access and isolate agents while preserving evidence. The firm also pointed to identity controls and API monitoring, since the exposed credentials show where the group found its footholds.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
