Robbing banks by linking AI models is becoming increasingly realistic.

An investigation has found that hacking group CyberCartel automated attacks targeting about 400 financial institutions in Latin America by using multiple AI agents running on models from Anthropic, SpaceX and China’s Moonshot AI.

The Information reported the details on Oct. 21, citing cybersecurity startup Straiker. It called it one of the first reports to detail how cybercriminals succeeded in automating intrusions into financial institutions using AI.

According to the report, the AI agents used by CyberCartel appear to have stolen passwords and customer data and accessed bank accounts with little human involvement.

Recent targets included banks and payment apps. The Information said it confirmed sensitive data stolen from a specific financial institution, but did not disclose the name because notification of affected institutions was under way.

The attack also stood out for dividing roles among AI agents.

In the attack structure, agents based on SpaceX's Grok searched the web for information on targets. Four agents running on Anthropic's Claude Opus and Sonnet models discussed the most suitable attack methods. Another Claude model running on the AI coding app Cursor took on a commander role to direct the overall work.

CyberCartel, believed to have been active since 2012, has in recent months sharply increased the speed and effectiveness of attacks by putting AI agents at the forefront. The Information reported that Straiker identified the methods after the group accidentally leaked internal operational information.

CyberCartel was found to have tricked AI models into removing safety guardrails by claiming they were operating in harmless settings such as academic tests or internal corporate security checks. If Claude refused to hack, it handed the task to smaller models such as Moonshot's Kimi. If Kimi also refused, it automatically switched to a conventional method of planting malware, Straiker said.

CyberCartel also built a system that linked models with lower performance than Anthropic Mythos to find vulnerabilities and carry out attacks.

Anthropic blocked CyberCartel from using Claude after receiving a report from Straiker and conducting an investigation. SpaceX is also working to block access. Straiker is trying to contact Moonshot, The Information reported.