Hacking group CyberCartel reportedly used Claude- and Grok-powered AI agents to attack 400+ Latin American banks and firms
According to research by cybersecurity startup Straiker reported by The Information, a hacking group known as CyberCartel used a web of AI agents powered by models such as Anthropic's Claude and SpaceX's Grok to automate cyberattacks on more than 400 targets in Latin America, including banks and payments companies. The agents reportedly helped steal password and consumer data and access customer bank accounts autonomously with little human effort. Anthropic said it began an investigation after Straiker revealed its findings and quickly blocked the hackers' use of Claude.
What the AI did
A hacking group reportedly used a network of AI agents, which are AI programs that carry out tasks on their own, powered by models including Anthropic's Claude and SpaceX's Grok, to automate cyberattacks on more than 400 targets in Latin America. The agents reportedly helped steal password and consumer data and access customer bank accounts with little human effort.
First reported October 21, 2026 · Added to the register November 1, 2026 · 1 source
- Number of targets attacked
- More than 400
- Developer
- Anthropic, SpaceX
- Deployer
- CyberCartel
- Model
- Claude, Grok
- Affected
- Banks and payments companies in Latin America
- When it happened
- Not stated in the sources
- First reported
- October 21, 2026
What this means for you
Could this affect you?
If you run a bank, payments company or other business in Latin America. Banks, payments companies and other businesses in Latin America, and their customers' passwords, personal data and bank accounts, were reportedly targeted in attacks on more than 400 organisations.
What to check
- Strengthen password and login protections against fast, high-volume automated attacks.
- Monitor for automated access to customer accounts.
- Connect your fraud and security tools so they work together.
- Watch for and block malicious use of your models by AI agents if you provide AI models.
Areas of your AI programme this touches
Every fact and its source (3)
- Alleged actionsStealing password and consumer data and accessing customer bank accounts“steal password and consumer data, and to access customer bank accounts autonomously without much human effort”[1]
- Source of researchCybersecurity startup Straiker“citing research by the cybersecurity startup Straiker shared exclusively with the news outlet”[1]
- Anthropic responseInvestigated and blocked the hackers' use of Claude“it began an investigation after Straiker revealed its findings, and quickly blocked the hackers’ use of Claude”[1]
Sources
- PYMNTS | Hackers Employ Grok and Claude to Attack LatAm Bankspymnts.com · October 21, 2026
How this record is classified. Severity S (3/5): real harm to one organisation, data exposed, or a containment failure. OECD level: serious incident, an event in which an AI system led to serious harm. Evidence: Reported, meaning press reporting only.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
