25,000 Records Leaked as AI Agents Automate Bank Heists in Latin America
CyberCartel uses Grok, Claude, and Moonshot AI to bypass security safeguards and steal financial data.
By Layla Fontaine ·
At least 25,000 customer records were exposed in a recent breach of Shinhan Bank in South Korea, a development that coincides with new findings on how artificial intelligence is accelerating theft in Latin America. The data leak involves personal credit information and marks the latest incident in a growing pattern of AI-driven financial crimes.
The hacking group CyberCartel has operated since 2012, targeting businesses across Latin America. For over a decade, the group relied on human-led intrusions. According to research from the cybersecurity firm Straiker, the group began deploying AI agents in recent months. This shift allows the group to target more organizations simultaneously and at a faster rate than manual hacking permits.
Straiker identified specific tools used by CyberCartel, including agents from SpaceX (Grok), Anthropic (Claude), and the Chinese lab Moonshot AI. The group circumvented standard safety checks by instructing the models to operate in test environments. When one model refused to proceed, the hackers switched to another. If that model also refused, the agents were assigned to deploy malware.
SpaceX and Anthropic have both reviewed Straiker's findings. Anthropic has already blocked CyberCartel's access to Claude. Straiker is currently attempting to contact Moonshot AI to sever its connection to the group. The research indicates that the group has not used Anthropic's Mythos model, despite the model's earlier warning about potential vulnerabilities.
The incident follows a November 2025 disclosure by Anthropic regarding its AI being used in a cyberattack. Researchers have also used Claude to breach OpenAI security systems, though those operations were non-criminal. The current activity by CyberCartel represents a distinct shift toward automated, large-scale theft.
South Korean authorities are investigating similar issues affecting Hana Bank, KB Kookmin Bank, and Shinhan Bank. The leak of 25,000 Shinhan Bank customer records occurred just days before the release of Straiker's report. This timing highlights the concurrent threat AI poses to financial institutions on two continents.
Nvidia recently launched the Open Agent Safety Platform to address these risks. The platform uses a new hardware and software security stack to contain rogue AI agents. It is designed to prevent agents from escaping sandboxes, executing unauthorized code, or bypassing guardrails. The launch comes as companies seek technical solutions to contain the autonomy of AI systems used in cyberattacks.
