Straiker: Gang Ran Claude and Grok Agents on Banks

A criminal group attacking Latin American banks organised commercial AI models into a team, giving each one a job and letting them argue over targets before an AI “arbiter” picked a plan. That is the account security firm Straiker gave on 21 October, in research it says was rebuilt from the group’s own working files. Straiker says the system, which the group called CARLIY0S, was used against more than 400 financial targets.

The report names models from Anthropic, xAI and Moonshot AI’s Kimi. It also records the defensive side. Before publishing, Straiker shared what it found with the providers. Anthropic then revoked the credential the group used to reach Claude, and xAI began looking into the activity. Everything below is Straiker’s account; the victims are anonymised and the findings have not been independently verified.

In brief

What happened: Straiker says a group it links to the long-running CyberCartel operation used Claude, Grok and Kimi models in a multi-agent attack system aimed at more than 400 financial targets in Latin America.
Why it matters: Straiker says this is the first look at a criminal group’s AI-run operation from the attackers’ own environment, not from the model provider’s side.
What’s next: xAI is investigating; Straiker has not said how many targets were breached or whether money moved.

What Straiker says it found

In its blog post and its longer threat report, Straiker’s STAR Labs unit says the operation was run by a team “operating as Tr4nsHack Team, under the front company Hexagon Security Labs Mexico”. It says the team includes known operators from CyberCartel, a group it has tracked since 2012 and which has targeted financial institutions in the region for more than a decade.

According to Straiker, the group moved from manual hacking and scripts to CARLIY0S, which was built on PentAGI, an open-source framework for automated penetration testing. Four roles based on Claude models were set up to assess attack options and debate targets, with one model acting as the final arbiter. A commander role ran as Claude inside the Cursor coding tool. Five Grok-based “miners” gathered stolen secrets, and Kimi models sat in a backup role.

Straiker says that on 24 September 2026 it accessed a snapshot of “FinancialSoft”, the group’s database of stolen credentials, holding 4,493 records. It says the inventory was “led by 2,911 email addresses, 903 account numbers”, alongside more than 270 penetration-testing reports on victims from May to September 2026. Some of the material, Straiker says, “could enable abuse of SPEI, Mexico’s interbank payment system”.

To get past the models’ safety rules, Straiker says, the group framed its requests as authorised security testing or academic exercises. When models still refused, the system switched to code the group had stored locally. Straiker has redacted the exploits, keys and credential dumps from its report and anonymised the victims.

How Anthropic and xAI responded

Straiker says it shared the relevant indicators with the AI providers before publication. “Anthropic has since revoked the compromised credential used to reach Claude, cutting off the swarm’s access,” it writes. “xAI has been notified and is actively looking into the activity associated with the five ‘Grok miners.'” Straiker adds that both providers “responded quickly”. xAI, the maker of Grok, is now part of SpaceXSI.

PYMNTS, summarising The Information, which first reported the research on 21 October, said the report carried a statement from Anthropic saying it began an investigation after Straiker revealed its findings and quickly blocked the hackers’ use of Claude. Neither Anthropic nor xAI has published its own account of the case.

Two caveats run through Straiker’s findings. First, one of the Claude roles is configured to use a model called Fable 5, but Straiker says a configuration entry does not show the model was ever successfully used, so it treats that as unverified. Anthropic’s September 2026 threat report said none of the misuse cases it covered involved its Fable or Mythos-class models, apart from one distillation case. Second, holding stolen credentials does not prove they were used. Straiker does not say how many of the 400-plus targets were breached, whether any money moved over SPEI, or whether victims were told.

The case follows other reports of attackers using AI tooling, including the open-source hacking tool CrowdStrike linked to attacks on South Korean banks and Microsoft’s account of a China-aligned group using AI agents. G7 finance leaders have already agreed to run exercises simulating AI-driven cyber attacks.

One revoked credential cut off the Claude swarm, showing where defenders can act

The most useful detail in Straiker’s account may be the simplest. A system with a commander, four debating agents and an arbiter still reached Claude through a credential, and once Anthropic revoked it, Straiker says, the swarm lost access. Commercial models are reached through provider accounts, and a provider can switch those accounts off.

That puts model providers in a defensive role. They can only act on what they can see, which is why Straiker’s decision to share indicators before publishing mattered as much as the research itself. Anthropic’s revocation, and the statement reported by The Information that it opened an investigation, show the loop working: an outside researcher spotted the abuse, the provider confirmed it and cut access. xAI’s inquiry into the Grok miners is the next test of the same process.

The account also shows the limits of that lever. Straiker says the group kept local code to fall back on when models refused, so cutting off one provider slows such a system but does not necessarily stop it. Straiker’s own list of defences puts much of the work on the targets. It calls for continuous adversarial testing of applications and AI agents, runtime detection that can block attacks inline, and an “agentic kill switch” to revoke tool access and isolate compromised agents while keeping evidence. Straiker sells products in this area, so its prescription is a vendor’s view, but the provider takedown it describes is the same kind of control applied one level up.

The stolen keys, not the models, are the most urgent risk for banks

Straiker’s inventory is dominated by things that work without any AI at all: email addresses, account numbers, API keys, cryptographic keys, passwords and database logins. The models, on Straiker’s account, helped the group find and collect these faster. The keys themselves are what could open payment systems, which is why Straiker flags the possibility of abuse of SPEI.

For a bank, that changes the order of work. Revoking a provider credential protects nothing if the keys the swarm has already gathered stay valid. Straiker itself says the investigation “reinforce[s] the need for strong identity controls, API security, and monitoring”. In practice that points to rotating any keys and passwords that could have been exposed, watching for use of old credentials, and checking payment interfaces for unusual activity, all ordinary controls, none of which depends on knowing which model was involved.

The gaps in the public record cut the other way too. Because Straiker anonymises the victims and does not say which keys were used, no bank can tell from the report alone whether it is affected. That leaves the institutions dependent on direct contact from Straiker or the authorities. The quote Straiker’s chief executive gave The Information, “Offense is way ahead of defense right now, that’s just how it is”, is one vendor’s view; the controls that would answer it are mostly familiar ones.

What happens next

xAI is still looking into the activity linked to the five Grok miners. Straiker’s report leaves open how many of the 400-plus targets were actually breached and whether any of the stolen payment credentials were used. The next useful disclosure would come from xAI’s findings, or from a bank or Mexico’s payment authorities confirming whether anything moved over SPEI.