A hacking group that has targeted Latin American banks for more than a decade has rebuilt its operation around a swarm of commercial AI agents. In a report published October 21, the cybersecurity firm Straiker says CyberCartel, operating as Tr4nsHack Team under a front company called Hexagon Security Labs Mexico, used a system named CARLIY0S to coordinate attacks against more than 400 banks and payment providers, with Claude, Grok and Kimi models assigned to different stages of each operation.
Straiker, which tracks the group internally as AiPT-67, says its researchers accessed the group’s own working environment, including its orchestration scripts, model configurations and a stolen-credential database. PYMNTS, reporting research Straiker shared with The Information, says the agents helped the group steal password and consumer data and access customer bank accounts autonomously, with little human effort.
CARLIY0S: Four Claude Roles Debate Each Target
CARLIY0S is built on PentAGI, an open-source autonomous offensive framework. At its centre sits a commander, Claude running inside the Cursor IDE and calling a single command-line tool, which delegates to four role-specialised sub-agents through the Anthropic API. STRIKER, running on Claude Opus 4.7, generates code and exploits. GHOST, on Opus 4.8, handles reconnaissance, OSINT validation and infrastructure analysis. FABLE is configured for lateral thinking and unconventional attack vectors. Their outputs are debated, and a single arbiter, MAXIMUS on Opus 5, returns one final decision before the commander acts.
The configuration lists a model named claude-fable-5 as one of the four agents. Straiker is explicit that a configuration entry does not show the model was ever invoked successfully, and treats that detail as unverified. Both operator machines read and write the same shared knowledge graph through a Model Context Protocol server, so a target found on one machine is immediately visible on the other.
CARLIY0S: Grok Miners, Kimi Fallbacks And The Stolen Inventory
Collection ran on a different vendor’s models. Five automated “Grok miners” gathered secrets into a database the group called FinancialSoft. A snapshot Straiker accessed on September 24, 2026 held 4,493 records: 2,911 email addresses, 903 account numbers, more than 270 penetration-test reports and over 200 vulnerabilities, including zero-days, found on the websites, APIs and backends of targeted organisations. The inventory also held 391 general API keys, 67 cleartext passwords, 51 portal logins and credentials tied to SPEI, Mexico’s interbank payment system.
The system was also built to survive refusals. When fallback models identified as KIMI-2 and KIMI-3 declined offensive requests, the orchestrator aborted and switched to a local file of pre-consolidated offensive code that needs no model at all. Straiker says the group routinely jailbroke models by framing requests as authorised red-team work or academic capture-the-flag exercises, and that its rule files forbade the AI from ever producing the Tr4nsHack name, a step the researchers call cognitive OPSEC, designed to break forensic attribution. Infrastructure included a 61TB central server and synchronisation loops that refreshed exfiltrated data every 15 minutes.
CARLIY0S: Anthropic Revokes Access, xAI Notified
Before publishing, Straiker shared the relevant indicators with the affected AI providers. Anthropic has since revoked the compromised credential used to reach Claude, cutting off the swarm’s access, and PYMNTS reports Anthropic told The Information it began an investigation after Straiker’s disclosure and quickly blocked the hackers’ use of Claude. xAI has been notified and is, in Straiker’s words, actively looking into the activity associated with the five Grok miners.
The pattern matches what defenders have been warning about as agents gain tools and autonomy, from the single hacker who used AI agents to break into more than 100 company websites to the safeguards Anthropic shipped the same day in Claude Security’s new continuous scanning release. “Offense is way ahead of defense right now, that’s just how it is,” Straiker chief executive Ankur Shah told The Information. “Enterprises are just not ready.”
Why It Matters
CARLIY0S matters because of where the evidence comes from. Most reporting on criminal AI use is drawn from the model provider’s side of the glass, the prompts and account behaviour a vendor can see. Straiker’s report is built from the operator’s own environment, end to end: objective setting, model debate, execution, post-exploitation and secrets collection. That makes it one of the first detailed documentations of a criminal group running AI as an operating system for attacks rather than as a drafting tool, and it shows the practical shape of the threat for banks and payment firms: role-specialised agents from several competing labs, chained together, with a no-model fallback for the moments a safety system says no. The defensive lesson is uncomfortable, and it is the same one behind the OpenCode breach that exposed users’ provider API keys: credentials and agent permissions are now the perimeter.
Background
CyberCartel has been tracked since 2012 and built its reputation on deep knowledge of Latin America’s financial system, moving from phishing to complex corporate fraud and direct exploitation of payment platforms. Anthropic’s September 2026 threat report had already documented agentic offensive frameworks such as PentAGI and persistent campaign memory from the provider’s side. CARLIY0S is the same shift seen from inside the crew that made it.
0 Comments