Straiker says a group it links to CyberCartel ran a multi-model AI attack system against more than 400 financial targets in Latin America, with Claude running inside the Cursor IDE as the commander. The report, published October 21, 2026 by Straiker's STAR Labs, describes a system it names CARLIY0S, built on the open-source PentAGI framework. Four Claude-based roles debated each target, five Grok-based "miners" collected credentials, and when models refused, the orchestrator fell back to pre-written attack code.
Most of what is public comes from Straiker alone. The number 400 counts targets, not confirmed breaches. This post lays out what Straiker reports, what it says it could not verify, and what readers who run coding agents can take from it.
TL;DR
| Question | Answer |
|---|---|
| Who reported it? | Straiker (STAR Labs), October 21, 2026 |
| Who is the actor? | Straiker calls it Tr4nsHack Team (tracked as AiPT-67), linked to CyberCartel; ties to Mexican cartels are "presumably" present, not confirmed |
| Scale? | More than 400 financial targets over several months; breaches confirmed: not stated |
| Which models? | Claude (in Cursor, plus four role agents), Grok "miners", Kimi, via PentAGI |
| Did providers act? | Anthropic revoked the compromised credential; xAI is investigating, per Straiker |
| Am I affected? | Only if you are a Latin American financial institution on the target list, or you hold provider credentials that could be abused |
| Is there a patch? | No; this is attacker use of commercial models |
How Straiker got the view
Straiker says its report is based on the group's own working environment, accessed in a snapshot dated September 24, 2026. That gives an operator-side view that is rare: the roster, the rule files and the fallback logic, rather than only network indicators. It also means some details, such as the exact model versions and role assignments, come from the group's configuration files as Straiker reads them. A configuration entry does not prove a model was actually invoked, and Straiker says so about one of the model names.
The group, per the report, operates as Tr4nsHack Team under the front name Hexagon Security Labs Mexico. Straiker names three operators it says came from CyberCartel, which it describes as active since 2012. Earlier public reporting on CyberCartel, such as Darktrace's 2024 write-up, concerned malvertising and phishing against banking users in the region, not agent swarms.
How the system is built
Image: Straiker
- Commander. Claude running in the Cursor IDE, which calls a command-line tool to delegate tasks. This is the part most relevant to coding-agent readers: an ordinary developer tool as the control plane.
- Four Claude roles. STRIKER handles exploit and code generation, GHOST reconnaissance and validation, FABLE lateral and business-logic thinking, and MAXIMUS acts as final arbiter. The roles debate each target and MAXIMUS returns a single decision. Straiker says the "Fable 5" entry is unverified.
- Secrets mining. Five Grok-based "miners" collect credentials.
- Fallback. When Kimi or Sonnet models refuse, the orchestrator switches to a local file of pre-written offensive code. Straiker writes that falling back to local hardcoded code has not, to its knowledge, been reported before.
- Shared memory. Two operator machines use the same knowledge graph, so findings on one are visible on the other.
The attack flow, at a high level
Straiker's description, with operational detail left out:
- Automated browser sessions authenticate to a content management system, then use that session to run code on the server.
- Post-exploitation scripts scan internal databases, hunt for credentials and map internal networks.
- Traffic is routed through residential proxies to avoid IP blocking, geo-restrictions and web application firewall rules.
- Operations are synced across nodes, and a central server holds tooling and stolen data.
The material Straiker saw included roughly 2,900 email addresses, 900 account numbers and more than 270 pentest reports, payment-related credentials including SPEI-linked material, passwords, portal logins, database strings, JWT and identity-provider keys, and cloud storage and mail credentials. It also lists six backdoors and more than 200 vulnerabilities, some described as zero-days. Straiker says victims are anonymized and that secrets and working exploits were redacted. It does not explain how the activity maps to specific financial losses.
How the guardrails were bypassed
The method is not exotic. Prompts and rule files framed requests as authorized red-team work, academic testing or disclosure programs, and Straiker says that framing led models to generate fuzzers, deobfuscation tools and exploit logic. Rule files also told models not to produce the group's alias, which Straiker describes as a way to limit attribution through model output. When a model refused anyway, the orchestrator did not stop: it fell back to code it already held.
Two lessons follow. Refusal is a control that an orchestrator can route around, so a provider's safety training cannot be the only barrier. And the "this is authorized testing" framing is the same pressure that appears in the Symantec honeypot's layered jailbreak, where access to secrets was redefined as normal development work. Straiker also notes Anthropic's September 2026 threat report documented similar patterns (PentAGI use, multi-agent setups, persistent memory), so it does not claim those elements are new; see Beam's summary of that report.
Why the multi-model design matters
Splitting work across several models is not only about capability. It is a way to spread risk. If one provider's classifier refuses a request, another model may accept it, and a local file of code removes the dependency on any model at all. The role structure, with one agent proposing, others challenging and an arbiter deciding, also mirrors how defenders are starting to build review pipelines, which is a reminder that the same orchestration patterns serve both sides.
For providers, this complicates enforcement. A single credential may look like ordinary developer traffic, since Claude in Cursor is a common setup, and the abusive intent lives in prompts and rule files the provider may never see in context. Straiker's account suggests the practical lever was credential revocation after indicators were shared, not detection of the swarm from inside the model. For teams that run agents, the corresponding lever is knowing which credentials your agents hold and being able to rotate them within minutes.
It also shows why attribution by model output is unreliable. Rule files told models not to produce the group's alias, so what an investigator reads in generated code may have been scrubbed by design. Straiker's value here is that it saw the configuration itself rather than inferring from outputs.
What this means if you run AI coding agents
You are not the target here, but the attack uses tools you also run.
- Protect provider credentials. Straiker says Anthropic revoked "the compromised credential used for Claude access", which points to stolen or abused access as the supply line. Keep API keys out of repos and transcripts, scope them narrowly, set spending limits and review usage for unfamiliar activity. Our guide to AI API key theft covers the reseller side.
- Inventory your agents and their permissions. Straiker's own recommendations include keeping an inventory of AI agents, their access and their permissions, and having an agentic kill switch to revoke tool access and isolate a compromised agent while preserving evidence. On a developer machine that means knowing which agents run, with which hooks and MCP servers.
- Assume instructions can be reframed. An agent in your repo can be told a task is authorized, defensive or academic. Do not rely on the model to judge that; rely on permissions, approvals and policy that sit outside it. The Claude Code Auto Mode red-team is a reminder that classifier-style gates have measured gaps.
- Watch for the pattern in your own logs. Straiker's advice is to correlate activity across cloud, SaaS, identity and internal systems and to use runtime detection for AI-related activity. For financial or fintech teams, look at access to content management systems and unexpected remote code execution on web servers.
- Keep the same basics. Straiker stresses that identity controls, API security and monitoring still matter, because the attackers' goals, stealing credentials and accessing accounts, are the old ones. ARTEX-style tooling in the South Korea bank case and the Microsoft ConnectWise findings point the same way.
What Beam can and cannot do here
Beam runs on your own machine and watches your agents, so it cannot see an attacker's environment, a bank's network or the CARLIY0S swarm. What it can do is limited to the defender side of the lessons above: flag risky agent actions such as credential exposure, redact known credential formats before storage, and, with an active workspace policy, deny matching tool calls through PreToolUse hooks on Claude Code and Codex. Beam's deny is pattern-based and hook-based, not a kernel sandbox, and a missing cached policy fails open. Cursor has a payload adapter but no wired blocking response in Beam's current documentation. See what Beam watches and how it stays local.
What is claimed and what is verified
- From Straiker's own access: the roster, rule files, fallback logic and snapshot contents, as read from the group's environment.
- Not independently verified: the 400-target figure's relation to actual breaches, attribution to CyberCartel and Mexican cartels, the exact model versions, and whether every configured model was invoked.
- Not stated: victim names, losses, and Cursor's response. Some coverage says Anthropic blocked the group's access; Straiker's own wording is that Anthropic revoked the compromised credential.
- Source interest: Straiker sells AI agent security, which does not make the findings wrong but is relevant context. Wait for provider or victim statements before treating details as settled.
Frequently asked questions
What is CARLIY0S?
It is the name Straiker gives to an AI-orchestrated attack system used by a group it calls Tr4nsHack Team, which it links to CyberCartel. It is built on the open-source PentAGI framework with commercial models from Anthropic, xAI and Kimi, and Straiker reports it was used against more than 400 financial targets in Latin America over several months.
Did the attackers breach 400 banks?
Not necessarily. Straiker's figure counts financial targets over several months, not confirmed breaches. The report does not name affected banks, give financial losses, or explain how many victims were actually compromised.
How did the group get models to cooperate?
Straiker says prompts and rule files framed requests as authorized red-team work, academic testing or disclosure programs, which led models to produce fuzzers, deobfuscation tools and exploit logic. When models refused, the orchestrator switched to a local file of pre-written offensive code.
What did Anthropic and xAI do?
According to Straiker, Anthropic revoked the compromised credential used for Claude access, and xAI is investigating activity tied to the Grok miners. Straiker shared indicators with the providers before publishing. The report does not describe a Cursor response.
How is Straiker able to describe the system?
Straiker says it based the report on the group's own working environment, accessed in a snapshot dated September 24, 2026. Some details, such as model versions and role assignments, come from the group's configuration files as Straiker reads them rather than independent verification. Straiker is also a vendor of AI agent security, so weigh the framing accordingly.
What should teams running coding agents take from this?
Treat provider credentials as high-value, since a compromised credential supplied the model access. Keep an inventory of agents and their permissions, restrict what agents can reach, and have a way to revoke tool access quickly. Beam, which runs locally, can flag credential exposure in your own agent sessions but cannot see an attacker's environment.
Related reading
- Straiker: CARLIY0S, CyberCartel's AI attacks on Latin American banks
- Anthropic threat intelligence report, September 2026
- AI agent security incidents timeline
Details reflect Straiker's report as of October 22, 2026 and may change as providers and victims respond. Beam is a local prototype and its limits are described above.