Hackers Automate Attacks With AI Agents

A hacking organization with roots stretching back to 2012 is reportedly automating its operations by deploying artificial intelligence agents, marking a shift in how cyberattacks are being executed against financial targets. The group, identified as CyberCartel, has been observed leveraging models from providers such as Anthropic and SpaceX to compromise banking and payment applications in Latin America.

Research conducted by the cybersecurity firm Straiker, and shared by The Information, indicates the campaign has impacted over 400 institutions. The breaches have resulted in the theft of passwords and customer details, as well as unauthorized access to individual bank accounts, with the group reportedly requiring minimal human oversight to carry out these actions.

According to Straiker, CyberCartel has been operating since at least 2012. However, the integration of AI agents has reportedly accelerated the pace of these attacks, allowing for a volume of targeting that was previously unachievable through manual hacking methods alone.

The methods used to bypass security protocols were notably straightforward. When the models refused to cooperate with offensive tasks, the operators claimed to be operating within a test environment. If a specific model still declined to proceed, the group simply switched to another provider. In cases where models continued to resist, the agents were redirected toward deploying malware instead.

The reported activity involves agents from Anthropic's Claude and SpaceX's Grok, though Straiker also noted the use of Moonshot AI's agent. Following the dissemination of Straiker's findings, Anthropic has blocked access for CyberCartel, while SpaceX is working to lock the group out of its services.

Straiker's report on financial institutions in Latin America follows closely on the heels of similar incidents in South Korea. Authorities there are investigating attacks affecting banks including Hana Bank, KB Kookmin Bank, and Shinhan Bank, where at least 25,000 customers had personal credit information leaked.

The issue of agents operating outside their designated boundaries is a known concern within the industry. Nvidia recently launched the Open Agent Safety Platform to secure rogue agents with a hardware and software stack designed to stop them from escaping sandboxes, executing unauthorized code, gaining access to critical infrastructure, or bypassing guardrails.