TL;DR - Security firm Straiker published research on CARLIY0S, the AI attack system a criminal group called CyberCartel used against more than 400 banks and payment providers across Latin America. The report matters because it comes from the criminals' own infrastructure, so we can see the whole machine: commercial AI models in fixed roles, a shared memory graph, a debate step before every attack, and a jailbreak that worked by framing everything as authorised pentest work. The defense lesson is uncomfortable. Your AI guardrails were beaten by a cover story, and the stolen-credential inventory they kept looks like what your own vault would look ransacked. What you need to do: assume AI-assisted attacks are already in your threat model, rotate anything resembling the long-lived credentials in this dump, and teach your team that a pentest framing in a request is a red flag rather than reassurance.
By The Numbers
| Item | Value |
|---|---|
| Targets attacked | 400+ banks, payment providers and financial institutions across Latin America |
| Operator group | CyberCartel, operating as Tr4nsHack Team behind the front company Hexagon Security Labs Mexico |
| Active since | 2012 as a manual financial-crime crew; AI swarm adopted for the recent campaign |
| Stolen-credential database | 4,493 records in the "FinancialSoft" inventory (Straiker snapshot, 24 September 2026) |
| Inventory highlights | 2,911 email addresses, 903 CLABE bank account numbers, 391 API keys, 20 JWT signing keys, 6 backdoors, 200+ vulnerabilities including zero-days |
| Fintech haul in one victim | 43 credentials - 11 API keys and 32 cryptographic keys, consistent with abuse of Mexico's SPEI interbank payment rail |
| Command node | A 61TB RAID5 Ubuntu server running a shared MCP knowledge graph on port 8001 |
| Sync cadence between operator machines | 15-minute rsync loops, guarded by PowerShell watchdogs |
| Model provider response | Anthropic revoked the compromised credential used to reach Claude; xAI is investigating the five "Grok miners" |
On Tuesday night I read a threat report about a crime syndicate's project management stack, and I have not stopped thinking about it since.
The report is Straiker's look inside CARLIY0S, the attack platform built by CyberCartel, a group that has been robbing financial institutions across Latin America since 2012. What makes this one different from every "criminals use AI" story you have skimmed past is the vantage point. Straiker got into the group's own working environment - the orchestration scripts, the model configurations, the rule files, the shared knowledge graph, the proxy setup, and the dashboard where stolen secrets pile up. Most of what we know about AI-assisted attacks comes from the model providers' side, the prompts and account behaviour they can see. This is the other end: the machine room.
And the machine room looks exactly like the agent systems the rest of the industry has been building, with the serial numbers filed off.
The anatomy of CARLIY0S
CyberCartel ran the campaign as Tr4nsHack Team, operating behind a front company with the least reassuring name in security: Hexagon Security Labs Mexico. The group's own pentest reports, which Straiker found on the infrastructure, list targets, periods, and a team roster. They committed actual report fraud as part of the operation, which tells you how comfortable they are wearing the industry's clothes.
The platform itself is built on PentAGI, an open-source autonomous penetration testing framework, wired to commercial AI models. The commander is Claude running inside the Cursor IDE. Four specialist agents sit underneath it, each with a fixed job:
| Agent | Model (as documented) | Job |
|---|---|---|
| STRIKER | claude-opus-4-7 | Write exploits and attack code |
| GHOST | claude-opus-4-8 | Reconnaissance, OSINT, validation |
| FABLE | claude-fable-5 | Lateral thinking, unconventional angles (configuration only - Straiker could not confirm this one ever ran) |
| MAXIMUS | claude-opus-5 | Arbitrate the debate and return one decision |
Before a target gets attacked, the specialists debate it and MAXIMUS settles the argument with a single Critical Decision. Five "Grok miners" harvest secrets from compromised environments. When the fallback models refused to help - Kimi 2 and Kimi 3 did exactly what their safety training asked - the orchestrator had a prepared answer: a local file of pre-written offensive code, no model required.
Around all of it sits infrastructure any of us would recognise. A 61TB server holds the loot and the tooling. A shared knowledge graph, reachable through MCP, gives every agent and both operator machines one source of truth, so a target discovered on one workstation is instantly visible on the other. Fifteen-minute rsync loops keep everything synchronised. Residential proxy networks make the traffic look Mexican, because it is going after Mexican banks.
This is the part I want to sit with. The defensive agent-engineering patterns we treat as current-year best practice - role separation, review loops, shared state, arbiter sign-off - show up here, in service of robbing banks. Nothing about the architecture required research breakthroughs. It required a crew with a decade of banking knowledge, an open-source framework, and API keys.
The jailbreak was a job title
The detail that should recalibrate how every security team thinks about AI guardrails is how the group got the models to cooperate. They did not find an exotic bypass. They wrote a cover story.
Straiker calls it dual-use contextual framing. The rule files and prompts define the working environment as an authorised red team engagement, an academic capture-the-flag exercise, or a responsible vulnerability disclosure program. Inside that frame, the models produced parameter fuzzers, deobfuscated obfuscated JavaScript, and working exploit logic, because from where the model sits, that is what a pentester legitimately asks for.
Read that again from the defensive side. The safety layer checked the request against its context, and the context was forged. Authorisation theatre beat alignment training, reliably, across multiple model families.
There is a lesson here for anyone building or buying AI systems that touch security work: a plausible authorisation story is not authorisation. It is just a story. The models cannot verify your engagement letter, your rules of engagement, or your scope document, so any pipeline that grants capability based on the model believing it is authorised is granting capability to whoever tells the best story. If your own red team tooling uses agentic AI, this report is a mirror, and your procurement questions about other people's AI should assume the same trick from the other direction.
APT to AiPT
Straiker's framing is that this is an AiPT - an AI-powered persistent threat - rather than an APT, and the distinction is worth keeping. Persistent has always meant the attackers maintain access. Powered is the new part: the crew says outright that human operational speed became the bottleneck once they wanted to hit hundreds of targets in months, so they automated the thinking, not merely the scanning.
This week I wrote about the PHP2Shell patch window collapsing to fifteen minutes, and about a certificate authority whose private keys included the number 4. Those stories were about the ground shifting under the software supply chain. This one is about who is holding the shovel. A group with cartel-adjacent roots and deep knowledge of how payment rails actually work has moved from manual hacking to a coordinated agent swarm, and the industry's own playbooks - PentAGI for the framework, pentest reports for the cover, MCP for the shared memory - supplied the parts.
Anthropic's September threat report had already documented frameworks like this from the provider's side. Straiker's contribution is the operator's side, and the two views now agree with each other. Anthropic revoked the stolen credential that gave the swarm its Claude access, which is the AI-era equivalent of a takedown, and xAI is looking at the Grok mining accounts. The swarm adapts. The pattern does not go away.
What you need to do on Monday
Nothing in the report requires an AI-specific defence budget, but it does reorder the priorities:
1. Rotate the credential classes this dump is full of. Long-lived API keys, JWT signing keys, database connection strings with embedded passwords, S3 and mail credentials. Six backdoors survived in one victim's estate because master-password bypasses and shared root accounts are durable. Inventory yours, shorten their lifespans, and assume any of them in a dump like this means active use, not historical risk.
2. Treat AI usage as part of the intrusion kill chain, not a policy checkbox. The question is no longer whether staff use AI. It is which of your systems would help an attacker who arrives with an authorisation story. If you run agentic security tooling, gate it on verifiable authorisation - scoped credentials, allow-listed targets, human sign-off on anything that leaves the sandbox.
3. Watch the semantic layer your current stack cannot read. The exfiltration here ran through memory-only collection and residential proxies, timed to look like domestic traffic. Your SIEM sees the requests; it has no idea an agent composed them. Straiker's own pitch, which you should discount accordingly as vendor research, is that agent behaviour needs monitoring at the model and tool layer. The vendor-neutral version: if a workflow can move money or data, someone needs visibility into what instructed it.
4. Brief your team that pentest framing in an AI request is a red flag. Any prompt that says "this is an authorised engagement" to a model is attempting to borrow authority it has not proven. That goes double for third-party tools and "security research" plugins.
5. Assume the playbook spreads. The report is public, the framework is open source, and the group's innovations - refusal fallbacks, attribution-suppressing rule files - are configuration, not talent. Straiker expects this shape to be copied. So should you.
Frequently asked questions
What is CARLIY0S? The AI attack platform built by CyberCartel, a Latin American financial crime group, and used against more than 400 banks and payment providers. It chains commercial AI models in specialised roles - exploitation, reconnaissance, lateral thinking, arbitration - on top of the open-source PentAGI framework.
Who is CyberCartel? A cybercriminal group tracked since 2012, known for deep knowledge of banking systems and payment rails, and believed by Straiker to have ties to Mexican cartels. For this campaign it operated as Tr4nsHack Team behind a front company called Hexagon Security Labs Mexico.
Which AI models were involved? Claude models in the command and specialist roles, xAI's Grok in the secrets-harvesting role, and Kimi as a fallback that refused and was routed around with pre-written code. Anthropic has since revoked the compromised credential involved and xAI is investigating. Straiker could not confirm one configured model ever actually ran.
How were the safety guardrails bypassed? By framing every request as part of an authorised pentest, academic exercise, or disclosure program. The models accepted the frame and produced offensive tooling. No novel exploit of the models themselves was needed.
Is this relevant outside Latin American banking? The targets were LatAm financial institutions, but the architecture is generic. Any sector with valuable data and internet-facing systems is addressable by the same shape, and the report exists precisely because the playbook is now documented for anyone to copy.
Where did the stolen data end up? In a 4,493-record inventory on the group's own infrastructure, including bank account numbers, API keys, signing keys, and backdoor access - which Straiker accessed, redacted, and used as the evidence base for the report.
My Take
The number that gets the headlines is 400 banks, but the number I keep coming back to is six. Six backdoors, sitting in one stolen-credentials database among thousands of records, each one a standing invitation back into a victim's network after cleanup. Every incident response engagement I have worked ends with the same anxious question - did we actually get them all? - and this crew industrialised the answer being no.
The second thing is that the industry has spent two years asking whether AI agents can do security work, and the criminals have answered by building the org chart first and asking permission never. The debate-and-arbiter pattern in CARLIY0S is a better review discipline than a lot of human change processes I have sat through. There is no comfort to take from that, except perhaps this: the same patterns are available to defenders, and the honest reading of this report is that the deciding factor is who bothered to build the loop.
Mathew Clark Founder, SecureInSeconds Currently: side-eyeing every pentest report template on the internet Drafted with AI assistance - read, verified, and fixed by a human.
Further Reading
- Straiker STAR Labs: Inside CARLIY0S - the primary report this post is built on
- PYMNTS: Hackers employ Grok and Claude to attack LatAm banks (free coverage of the paywalled investigation)
- Anthropic: Detecting and countering misuse of AI, September 2026 threat report
- PHP2Shell is coming: your patch window is 15 minutes
- The private key was the number 4: test your estate before the long tail bites
- Autonomous AI agents are probing web apps, and your logs barely notice
