Hacker Group Uses Claude and Grok Agents to Automate Attacks on Over 400 Latin American Institutions
A group calling itself CyberCartel reportedly used AI agents including Anthropic's Claude and xAI's Grok to automate attacks on banks and payment apps across Latin America, stealing credentials and account data from more than 400 institutions.
According to Tom's Hardware, a hacker group calling itself CyberCartel used AI agents including Anthropic's Claude and xAI's Grok to launch automated attacks on banks and payment apps in Latin America, stealing passwords and account information from more than 400 institutions. The report says the attack chain was executed end-to-end by AI agents rather than relying on manual, step-by-step operations.
The affected targets are concentrated among financial institutions and payment apps in Latin America, with stolen data including login credentials and account details. There is currently no public information indicating that the AI vendors involved have commented, and neither the specific list of victim institutions nor the scale of losses has been disclosed.
The case brings the automation capabilities of AI agents on the attack side into focus: when agents can carry out reconnaissance, phishing and credential theft at scale, defenders face mounting pressure to determine "who is making a request and whether the request is legitimate." For payments and settlement, credential leaks translate directly into account takeover and unauthorized transaction risks.
Source: https://news.google.com/rss/articles/CBMi-gJBVV95cUxQUzNXWU9mdGNtWGktLVRRVm5KdFA0Zjd4Q29SeWs0T1lCbDF5YWdGc1BscVZSNDV5SkNzdGlPYjZuZEpfNjQ5ZTd0NUhMeHNDNHNzN01PWGFDYnNLV0ZYeEhKOE9NRjZGb3Vwb3V1NUpyZkZCdldUZDVicDhRNEhSdUhSVWREOEVsSERvVDZYSjRJUF9zSW5OcWtxWHJNc0NkVVgzTDBVWGlkb01SaTRTUzBQQmVWTkI2TV9qQjJsc2Y0Mi0xeEJnRXR2aUxYZXpYNWltLTdsVHRVOThCMmJaV1F1RjRVbnpFZHd1Ym03QUo3MUFFNlFpbjhwbU5uNHFVSzB5SUFjSWRJN0FTSTVhTE04eE9TQ1U2bDdxZERIV2RRRTVzQnUzYmVQekxJaUs2WnJCTVRCeXpLZmlXdlFfRlUxZGtES2lud21XWFl5bmFCWUltT09BN2NBUUJWOWRSTzl5YkZJNUxHQnVqbkVfclY5cmpLeWJVelE?oc=5
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-10-24
- Last updated
- 2026-10-24
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
Harbor Enters AI Agent Insurance With $10M Seed Round, Leaving Liability Attribution and Claims Pricing as the First Unsolved Problems
South Korea's President Confirms AI Role in Attacks on Seven Financial Firms: A Look at the Attack Chain
NVIDIA Open-Sources Agent Security Platform: Another Piece in the Agent Security Infrastructure, from Testing to Deployment
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.