AI swarm targets 400 financial institutions, sidestepping model refusals

What this is about

US security vendor Straiker, which specializes in securing AI agents, published an analysis on October 21 of a system called CARLIY0S. The criminal group CyberCartel is said to use it to attack more than 400 banks, bank units and payment providers (fintech gateways) in Latin America over just a few months. Mexico and its SPEI transfer system are a particular focus. What sets it apart: a "swarm" of multiple AI models does work that used to require human coordination.

One caveat up front: the claims rest on a single source, a vendor of security tools for agents that recommends its own products at the end of its report. The editors of the original article couldn't independently verify the findings. Straiker also speaks only of "alleged" ties to Mexican cartels and offers no evidence for them.

The group and the data behind the report

Straiker tracks the group as AiPT-67 and dates its activity back to 2012. It reportedly operates as "Tr4nsHack Team" with a front company in Mexico. According to Straiker, the victim data covers May through September 2026. The researchers say that on September 24 they viewed a snapshot of the database of stolen credentials (4,493 entries), orchestration scripts, model configurations and a victim dashboard. Latin American cybercrime has long relied on banking trojans, identity theft and money couriers. AI agents mainly change throughput: machines replace the human coordination that used to limit the number of parallel targets.

A swarm with distributed roles

CARLIY0S is built on PentAGI, an open-source framework for automated penetration testing (that is, probing systems for vulnerabilities). The team is organized like a human crew:

• Commander: Claude, running in the Cursor code editor, hands out tasks.
• GHOST: reconnaissance and research of public information.
• STRIKER: generates exploits (code that takes advantage of vulnerabilities).
• MAXIMUS: arbiter that makes a single "critical decision."
• A fourth role looks for ways to move laterally through the network.

The agents share a common knowledge graph, kept current by sync scripts, and follow rule files. According to the configuration, several versions of Claude Opus sit behind the roles. Straiker itself stresses that a configuration entry doesn't prove a model was actually called. Using multiple models lets agents debate targets and catch each other's errors and hallucinations (made-up output), and it keeps operations running. Human speed had been the group's bottleneck.

Dodging refusals

The swarm expects to be turned down. When a model rejects a task, CARLIY0S switches to fallback models, either Kimi from the Chinese lab Moonshot or Claude Sonnet, and finally to a local file of prewritten attack code. The instructions frame the work as an authorized penetration test or academic research, a context trick that model filters struggle to spot. In parallel, five agents built on xAI's Grok comb through the stolen data for secrets.

Anthropic and xAI responded after receiving Straiker's technical indicators in advance. Anthropic revoked the compromised credential the swarm used to access Claude, and xAI is investigating the activity of the five Grok agents. That cuts off one access path but doesn't neutralize a system built precisely to switch models and providers. Safeguards from any single provider are therefore not enough.

Techniques and loot

The entry methods are classic, just at scale. The agents use Playwright to drive a headless Chromium browser behind residential proxies (traffic looks like it comes from ordinary households) and inject Groovy code into instances of the Magnolia CMS content management system to execute commands remotely. With Burp Suite, connected via the MCP protocol, they intercept traffic, explore Oracle databases, hunt for credentials and map subnets. Straiker counts more than 200 vulnerabilities in the arsenal, some reportedly unknown to the vendors.

The real value lies in the technical keys. A signing key lets an attacker forge valid authentication tokens, and an API key lets them pose as a legitimate application. That opens up payment systems more reliably than a customer account does, and it barely gets noticed as long as nobody monitors usage. The fact that the group held its victims' pentest reports (one covers June/July 2026) also gave it a map of weaknesses that were already known.

What remains unclear

The report puts no figure on stolen sums or on how many of the roughly 400 targets were actually compromised, and it mentions "Sentinel transactions" without details. What makes the account plausible is that other publications the same day describe similar mechanisms. CrowdStrike named four actors steering intrusions with agents built on Claude Code, and Palo Alto Networks' Unit 42 described an actor that switches off DeepSeek V4's safeguards with a simple instruction. The overlap concerns the mechanism (an agent that chains steps on its own; a swappable model), not the scale.

Recommendations

Straiker's first advice is visibility: which agents are running in your systems, what do they access, and what are they allowed to do? Monitoring should span cloud, SaaS and internal systems so that events that look harmless on their own can be correlated. On top of that come a kill switch that strips an agent of tool access and isolates it while preserving evidence, continuous testing against concrete attack scenarios (including business-logic abuse and privilege escalation), and tighter identity controls and API security. In practice, the loot points to this: inventory, rotate and monitor API, signing and directory keys like privileged accounts. Unusual usage is a warning sign. Automated attackers are faster but leave recurring patterns that only correlated detection can connect in time.

Our take

The story shows less a new attack technique than a new form of organization: roles, arbiters and fallback models, the way companies build them for their own agents. The upshot is that model providers' filters are only one layer, and banks have to defend their own systems. The thin evidence remains a problem: one source with a commercial interest, no quantified damage, no independent confirmation, and model attribution that in part rests only on configuration entries.