Hackers Used Claude and Grok Agents to Attack Over 400 Latin American Financial Institutions, Study Says
A cybercrime group called CyberCartel used AI agents powered by models including Anthropic's Claude and xAI's Grok to automate attacks on banks and payment companies, according to research from security startup Straiker.
According to an October 21, 2026 report by The Information, exclusive research from cybersecurity startup Straiker shows that a hacker group called CyberCartel used multiple AI agents powered by models including Anthropic's Claude and xAI's Grok to launch automated attacks on more than 400 targets in Latin America, including banks and payment companies.
The report said the group used the agents to steal passwords and consumer data and to autonomously access customer bank accounts with limited human involvement. The Information described it as one of the earlier, more detailed cases of hackers using AI models to automate intrusions into financial institutions. Straiker CEO Ankur Shah told the media that attackers are currently clearly ahead of defenders and that companies are not prepared.
In a statement, Anthropic said it launched an investigation after being notified by Straiker and quickly banned the hackers' use of Claude. A September 2026 PYMNTS Intelligence survey showed that about 80% of financial institutions cited the complexity of new technology systems as a major innovation obstacle, up from 48% a year earlier. Although tools such as behavioral analytics and device fingerprinting are widely deployed, integration between systems remains an operational challenge.
Source: https://www.pymnts.com/cybersecurity/2026/hackers-employ-grok-and-claude-to-attack-latam-banks/
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-10-22
- Last updated
- 2026-10-22
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
Harbor Enters AI Agent Insurance With $10M Seed Round, Leaving Liability Attribution and Claims Pricing as the First Unsolved Problems
South Korea's President Confirms AI Role in Attacks on Seven Financial Firms: A Look at the Attack Chain
NVIDIA Open-Sources Agent Security Platform: Another Piece in the Agent Security Infrastructure, from Testing to Deployment
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.