INTEL: Hackers use AI to attack over 400 financial targets in Latin America

Hackers used artificial intelligence models including Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi to automate cyberattacks against more than 400 financial targets across Latin America.
The attacks were carried out by CyberCartel, a hacking group that used multiple AI agents to coordinate intrusions against banks, payment applications and other financial organizations.
According to an October 21, 2026 investigation by The Information, cybersecurity company Straiker uncovered evidence that the attackers stole passwords and customer information and gained unauthorized access to bank accounts with minimal human involvement.
Hackers target more than 400 financial institutions using AI
Straiker discovered CyberCartel’s automated hacking operation after the group accidentally exposed information about its internal activities.
The investigation revealed a network of AI agents designed to identify targets, search for security weaknesses and coordinate attacks.
CyberCartel has reportedly operated since at least 2012, but its adoption of AI has substantially increased the speed and scale of its operations.
Straiker’s findings indicate that the group targeted more than 400 financial organizations and services in Latin America.
The Information reviewed records of stolen sensitive information but withheld the identities of affected institutions because notification efforts were still underway.
How Claude, Grok and Kimi were used in the attacks
The attackers assigned different responsibilities to multiple AI models.
Grok was used to gather publicly available information about potential targets.
Four AI agents powered by Claude Opus and Sonnet analyzed possible attack strategies. Another Claude model operating through the Cursor coding application coordinated the overall operation.
When Claude refused to perform certain malicious actions, the system could transfer those tasks to alternative AI models including Kimi.
The attackers also attempted to bypass AI safety restrictions by disguising their instructions as legitimate academic research or authorized security testing.
According to Straiker, the system could fall back to conventional malicious software when AI-based methods failed.
This arrangement allowed the group to conduct sophisticated cyberattacks with considerably less direct human involvement.
Anthropic blocks attackers’ access to Claude
After Straiker disclosed its findings to Anthropic, the company investigated the activity and blocked the attackers’ access to Claude.
Straiker also shared its findings with the developers of the other AI systems involved.
The investigation highlights the challenges facing AI developers as cybercriminals combine multiple models to circumvent individual safety protections.
Rather than depending on a single AI assistant, attackers can distribute tasks across several models and automatically switch between them.
AI-powered cyberattacks raise concerns for banks
The findings demonstrate how artificial intelligence can accelerate attacks against financial institutions and potentially reduce the technical expertise required to carry them out.
Automated systems can investigate many targets simultaneously and continue operations with limited supervision.
The case adds to growing concerns about AI-enabled cybercrime affecting the global financial sector.
However, the reported targeting of more than 400 organizations does not establish that all were successfully breached.
The full extent of compromised accounts, financial losses and affected customers has not been publicly disclosed.