Hackers Used Claude and Grok to Fully Automate Attacks on Banks

A hacking group called CyberCartel used a web of AI agents powered by models from companies including Anthropic, SpaceX and Chinese lab Moonshot AI to automate cyberattacks against more than 400 Latin American financial targets, according to an investigation by the cybersecurity startup Straiker.

The research, shared exclusively with The Information, is one of the first detailed reports of cybercriminals using AI models to successfully automate attacks that break into financial institutions. The AI agents used by CyberCartel, which has long targeted Latin American businesses and whose latest targets included banks and payment apps, appear to have stolen passwords and customer data and to have accessed people’s bank accounts autonomously with little human effort, the Straiker research shows.

The findings indicate how AI is giving cybercriminals an edge against defenders, at least for now, as the models enable them to coordinate and carry out a large number of cyberattacks so rapidly that they overwhelm victims’ defenses. That’s a big reason so many companies are now pouring money into AI-powered defensive tools in an effort to level the playing field.

“Offense is way ahead of defense right now, that’s just how it is,” said Straiker Chief Executive Ankur Shah, whose firm sells software for monitoring and securing AI agents. “Enterprises are just not ready.”

After Straiker reported its findings to Anthropic last week, the AI giant investigated and quickly blocked the cybercriminals’ use of Claude, an Anthropic spokesperson said in a statement.

The Information reviewed records Straiker obtained showing sensitive data stolen from specific financial institutions, but is not naming them here because Straiker is still in the process of notifying affected parties.

Anthropic rattled the cybersecurity world this spring when it announced Mythos, its most sophisticated model, and warned that hackers could soon try to use models like it to overwhelm the defenses of banks and government agencies and wreak havoc. The CyberCartel campaign is the latest evidence that sophisticated cybercriminals have indeed started chaining together AI models that, even if they’re not as powerful as Mythos, can create systems that automatically find software vulnerabilities and carry out attacks.

Hackers had already been using AI to speed up similar cyberattacks. Cybersecurity firm CrowdStrike reported earlier this month that it found evidence that the perpetrator of a recent hack of South Korean financial institutions that resulted in data leaks used an open-source Chinese AI agent and Chinese large language models.

Straiker learned about CyberCartel’s AI-powered methods after the hacking group mistakenly leaked information about its internal operations.

While security researchers say CyberCartel has been active since at least 2012, the new AI agents have dramatically ramped up the speed and effectiveness of its attacks in recent months, Straiker said.

CyberCartel didn’t appear to need access to Anthropic’s Mythos for the attacks. Instead, they used AI agents powered by SpaceX’s Grok to mine the web for information about their targets, Straiker said. They also used four different AI agents powered by Anthropic’s Claude Opus and Sonnet models to deliberate over how best to carry out attacks, while another Claude model running in the AI coding app Cursor acted as the “commander” orchestrating the hacks.

The findings are significant because they show in detail how cybercriminals are automating the type of attacks OpenAI and Anthropic have been warning about in broad terms, according to Ken Huang, an AI security consultant and adjunct professor at the University of San Francisco who reviewed Straiker’s research. They also show how low the barrier to entry is for carrying out sophisticated hacks now thanks to AI, he said.

“Tokens and a harness are all you need,” Huang said. “It changes the primary bottleneck of an attack from human technical skill to API token budgets and compute.”

In theory, all of those AI models are built with guardrails meant to prevent them from agreeing to carry out such cyberattacks. But CyberCartel sidestepped those constraints by telling the AI models that they were operating in harmless environments such as an academic test or a company’s internal tests of its own systems. If Claude refused to carry out a hack, CyberCartel’s code would direct smaller models like Moonshot’s Kimi to actually hack the victims; if Kimi models also refused, the system of AI agents would automatically revert to a more old-school type of hack involving deploying malware, Straiker found.

Straiker said it shared its research with SpaceX and Anthropic and that both labs were working to prevent CyberCartel from accessing their models. Straiker said it was attempting to get in contact with Moonshot. SpaceX and Moonshot didn’t respond to requests for comment.

While alarming, the rise in cyberattacks fully automated by AI is something defenders have been bracing for in recent months. Other firms say they’ve seen a rise in activity on the part of hackers who appear to be assisted by large language models.

“We’re seeing an increase in automated probing of our environment. Automated attacks have been on the rise for 20-plus years and now LLMs are making it even easier,” said Scott Roberts, chief information security officer at enterprise software company UiPath. “We’re going to have to adjust on our security operations and detections side to adapt.”