On October 21, 2026, AI security firm Straiker reported that a criminal group called "CyberCartel" had operated an attack platform named "CARLIY0S," which combined multiple AI models, and attacked more than 400 finance-related targets over several months. According to the report, the platform used Anthropic's Claude split into four roles, five xAI Grok agents responsible for information gathering, Moonshot AI's Kimi, and other models. On September 24, Straiker also reviewed a database containing 4,493 records, including credentials the attackers had collected. However, the figure of "more than 400" is a count of attack targets. The number of financial institutions actually breached and the amount of damage have not been disclosed.
What distinguishes this report is that, unlike earlier cases in which AI model providers analyzed attacks from their own usage logs, Straiker examined the system's structure from the attackers' own working environment. That environment included a mechanism that, when an AI model refused an attack-related request, switched processing to pre-built local attack code. The finding highlights a question: how effective can the safeguards and access blocks of individual model providers be against an attack platform that mixes and matches multiple AI models?
What "400+ Targets" and "4,493 Records" Mean for the Actual Damage
The "more than 400" figure Straiker reported is the number of finance-related targets CyberCartel attacked over several months, not the number of institutions successfully breached. The "4,493" figure, by contrast, is the number of records stored in a database called "FinancialSoft," which Straiker's investigative agent accessed on September 24, 2026. This information was reportedly collected by five Grok-based information-gathering agents. Because the two figures differ in what they count and in time frame, they cannot simply be compared to estimate the scale of damage.
The main figures in the report are summarized below.
| Figure | What it counts | Date / period | Notes |
|---|---|---|---|
| 400+ | Finance-related targets attacked | Several months | A lower bound. Not the number of institutions confirmed breached |
| 4,493 records | Records stored in FinancialSoft | September 24, 2026 | A snapshot at the time of investigation; not necessarily the full extent of data held |
| 2,911 | Email addresses | September 24, 2026 | Records in FinancialSoft |
| 903 | Mexican standardized bank account numbers (CLABE) | September 24, 2026 | Records in FinancialSoft |
| 391 | General API keys | September 24, 2026 | Records in FinancialSoft |
| 43 | Credentials for one fintech company (11 API keys, 32 encryption keys) | September 24, 2026 | Could potentially be used to abuse payment systems |
| 270+ | Penetration test reports on victim organizations | May–September 2026 | A lower bound. Not included in the 4,493 |
FinancialSoft stored 13 types of records. In addition to the 2,911 email addresses, 903 CLABE numbers, 391 general API keys, and 43 fintech credentials in the table above, it contained 67 plaintext passwords, 51 portal login credentials, 43 database connection strings, 20 JWT signing keys, 20 Keycloak credentials, 4 digital certificates, 19 Wasabi S3 credentials, 15 Mailgun credentials, and 6 backdoors. These add up to 4,493. The 270+ penetration test reports and 200+ vulnerabilities are separate materials and are not included in this total.
The 903 CLABE records account for roughly 20% of all records, but that is a share of the records in the database, not a share of affected institutions or of financial losses. Straiker anonymized the victim organizations and categorized them as financial institutions, banks, and fintech payment gateways in Latin America, particularly Mexico, but it did not name specific institutions or give a country-by-country breakdown. As a result, it is unclear how many of the 400+ targets were successfully penetrated, or how many institutions the 4,493 records were taken from. Multiple pieces of information may have been stolen from a single institution, and some targets may have been attacked without any data being taken.
Regarding payment-related credentials, Straiker points to the possibility of abuse of Mexico's interbank payment system "SPEI." It also says this is consistent with test transactions observed during the operation, but it does not say whether fraudulent transfers were actually made or in what amount.
All of these figures are Straiker's own findings, and the report does not include independent confirmation from victim institutions or law enforcement. Straiker also sells attack-testing and runtime security products, and the end of the report includes information about its own services. The report's technical content and its claims about the scale of damage should be evaluated separately.
An Attack Platform That Splits Claude Into Four Roles and Uses Five Groks to Gather Data
CARLIY0S is built on "PentAGI," an open-source project published by VXControl. PentAGI is a multi-agent platform originally intended to automate authorized security testing and was not developed for criminal purposes. According to Straiker, CyberCartel's operators added their own scripts to PentAGI and built a configuration that assigned multiple commercial AI models to different stages of an attack.
The overall commander is Claude, running in the development environment "Cursor." It calls multiple Claude models through the Anthropic API and assigns them four roles: execution and attack-code generation, reconnaissance and analysis, exploration of unconventional intrusion routes, and final decision-making. The model names listed in the configuration file are "claude-opus-4-7" for execution, "claude-opus-4-8" for reconnaissance, "claude-fable-5" for intrusion-route exploration, and "claude-opus-5" for final decisions. However, "claude-fable-5" was only listed in the configuration file, and no evidence has been found that an API call to it actually succeeded. Straiker itself says it has not confirmed whether this model was actually used.
The Claude-based decision-making had two stages. First, three agents in charge of execution, reconnaissance, and intrusion-route exploration considered each target, and then the decision-making agent reached a conclusion. The structure examines attack methods from multiple perspectives before settling on an execution plan, but no quantitative data was presented on how much this improved attack success rates or efficiency.
Information gathering was handled by a separate group of agents. Five Grok agents, which Straiker calls "miners," collected secrets from targets and accumulated them in FinancialSoft. The operators used two machines and shared a knowledge graph through MCP (Model Context Protocol). MCP is a standard for connecting AI models to external tools and data, and in this environment, target information obtained on one machine could be referenced and updated from the other. Communications reportedly went through residential proxies to make it appear that access originated from within Mexico.
According to Straiker, the attackers tried to bypass the models' safeguards by presenting the work as authorized red-team engagements or academic research, posing as legitimate security testing. However, the AI did not carry out the entire attack autonomously; human operators remained involved throughout. The operators reportedly presented themselves as a front company, and Straiker analyzes that combining AI allows even a small criminal group to launch attacks on many targets and increase their speed.
What Differs From Anthropic's Investigations: Examining the Attackers' Own Working Environment
Anthropic has also published several cases of AI being abused for cyberattacks. On August 27, 2025, it announced that it had disrupted a data-extortion campaign that used Claude Code to target at least 17 organizations, including healthcare, emergency services, government, and religious institutions. In November of the same year, it reported that a group believed to be state-sponsored by China had used Claude Code to attempt intrusions into about 30 targets, succeeding in some. In that case, AI handled 80–90% of the work, with human decisions needed only about four to six times per operation, though failures were also observed, such as the AI generating nonexistent credentials.
In its November 13, 2025 report, Anthropic described an operating model for AI-driven autonomous cyberattacks, and its September 2026 report noted that similar techniques have spread among the various types of attackers examined. That September report also mentions PentAGI and analyzes how publicly available agent platforms give attackers a common foothold. However, greater AI autonomy is not the same as greater severity of harm. Target selection, verification of attack results, and monetizing stolen information still reportedly involve deep human participation.
The cyber-operation cases covered in Anthropic's September 2026 report span December 2025 to August 2026, and the models used were Haiku, Sonnet, and Opus. Anthropic says it has not observed malicious activity involving Fable or Mythos. Drawing on this statement, Straiker says it would be an important finding if the "claude-fable-5" in CyberCartel's configuration were confirmed to have actually been used, but it presents no evidence of this.
What sets Straiker's report apart from earlier investigations is the source of the information analyzed. Anthropic's reports analyze attacks from usage logs of its own services, whereas Straiker examined the attackers' orchestration scripts, model configuration files, and lists of collected secrets. From these, it reconstructed the whole mechanism, from goal-setting through execution and information gathering, from the attackers' environment. Straiker positions this as, to its knowledge, the first investigation to document an entire attack platform from this perspective, though it does not claim that PentAGI or multi-agent architectures themselves are new technology.
Note that the 17 organizations or roughly 30 targets in Anthropic's reports cannot be directly compared with Straiker's 400+. The environments observed, time frames, and ways of counting targets differ. Anthropic's reports also do not name CyberCartel, and it has not been confirmed that these were a series of attacks by the same criminal group.
When AI Refuses a Request, Processing Switches Automatically to Local Attack Code
Particularly noteworthy in Straiker's investigation is the mechanism designed to handle safety refusals by AI models. According to the report, in CARLIY0S, when an auxiliary model refused an offensive request, the orchestration script terminated communication with that model and switched processing to pre-built local attack code. The auxiliary models named in connection with refusals are "KIMI-2," "KIMI-3," and "SONNET-2." By moving processing to fixed code that requires no AI queries, the design allows the attack to continue even if a model declines to comply.
Straiker says it knows of no previously reported example of such an automatic switch to local fixed code. However, what is specifically shown is the behavior when an auxiliary model refuses; how processing is handled when the commander or the four role-playing Claude agents refuse is not made clear. The report body also contains a broader statement that the attack can proceed regardless of how many AIs refuse, but the concrete mechanism that can be verified concerns the auxiliary models. This difference needs to be kept in mind when evaluating the claim.
This design also matters for considering the limits of safeguards by individual AI providers. If one model refuses a dangerous request, processing that relies on that model stops, but if another AI model or a local program is prepared as an alternative, the attack platform as a whole does not necessarily halt. CARLIY0S incorporated not only Claude but also five Grok agents and auxiliary models such as Kimi, so even if Anthropic blocks access to its own services, that action does not directly extend to other companies' models.
According to Straiker, it shared relevant information with the AI providers before publishing the report. Anthropic reportedly revoked the compromised credentials that had been used to connect to Claude and blocked the attack platform's access to Claude. xAI was also notified and is reportedly investigating activity related to the five Grok agents. However, these are all Straiker's accounts, and the report does not include confirmation from Anthropic or xAI themselves. It is also unclear whether the revoked credentials belonged to the attackers or had been stolen from third parties.
While Anthropic's action cut off the connection to Claude, the Grok-based information-gathering stage awaits the results of xAI's investigation. Moreover, the collected information is stored in FinancialSoft, which is not under the AI providers' control. The local attack code can run without querying any model, and the communication path using residential proxies is independent of AI models. As a result, access blocks by model providers alone may not disable every function of the attack platform. That said, this report does not confirm that CyberCartel continued its attacks after the credentials were revoked.
This does not mean that AI model refusals or credential revocations are meaningless. Access to Claude was actually blocked, and auxiliary model refusals force the attackers to switch to alternative processing. The problem is that the materials available cannot measure how much these measures affected the execution of the attacks overall.
In its September 2026 report, Anthropic also noted that AI service API keys and session tokens themselves are becoming targets of attack. It explained that organizations need to protect AI API keys and agent integrations at the same level as credentials used in production environments. Responsibility for controlling access to AI does not rest with model providers alone; it also lies with the organizations that use them.
Common Ground With Measures Requested by Japan's FSA and the Bank of Japan
On May 22, 2026, Japan's Financial Services Agency (FSA) and the Bank of Japan asked representatives of financial institutions and others to take "short-term measures for financial institutions in light of changing threats from frontier AI." This document predates Straiker's report by about five months and was not issued in response to CyberCartel's activities. The main concern is that AI could discover large numbers of vulnerabilities in a short time, leaving conventional patching systems unable to keep up. The FSA and the Bank of Japan call for direct involvement by senior management, including top executives, and for priority to be given to protecting critical systems first.
In particular, externally exposed systems that support critical operations such as internet banking are listed as targets for priority action. In Straiker's report as well, the targets included fintech payment gateways. CyberCartel's materials also reportedly stored information on more than 200 vulnerabilities, including zero-day vulnerabilities found in websites, APIs, and backends, along with more than 270 penetration test reports on victim organizations. The makeup of these materials relates to the FSA and Bank of Japan policy of prioritizing protection of externally accessible systems.
Protecting credentials is also an important issue. In FinancialSoft, the 2,911 email addresses and 903 CLABE numbers make up a large share, but the database also contained many items directly tied to system access privileges. These include 391 general API keys, 67 plaintext passwords, 51 portal login credentials, 43 database connection strings, and 20 JWT signing keys. If abused, these could lead not just to information leaks but to unauthorized system access and misuse of privileges.
The FSA and Bank of Japan request includes introducing multi-factor authentication for privileged IDs and layered defenses using EDR (Endpoint Detection and Response). On the other hand, the management of API keys, signing keys, and database connection strings is not explicitly addressed individually in the request text. Considering that Anthropic calls for protecting AI service credentials at the same level as production environments, financial institutions need to include credentials used by APIs and AI agents in their review alongside conventional account management.
The FSA and the Bank of Japan also point out that responding to AI-driven cyber threats cannot be handled by IT or security departments alone. Assuming that attacks cannot be fully prevented, they asked top executives to consider even decisions about shutting down critical systems. If, as Straiker's report describes, an AI-combined attack platform can handle more than 400 targets over several months, the defending side may also need to respond faster than before. However, the FSA and the Bank of Japan have not offered any assessment of the CyberCartel case.
This report revealed the structure of an attack platform combining multiple commercial AI models and part of the credentials it collected. However, key points remain unknown, including the number of financial institutions actually breached, the financial losses, confirmation by Mexican authorities, and the results of xAI's investigation. Whether the "claude-fable-5" listed in the configuration file was actually used has also not been confirmed.
Still, it is significant that the report confirmed both a fallback process for when AI models refuse attacks and a division of labor spanning multiple providers. Additional explanations from Anthropic and xAI, along with independent verification, will be the basis for judging the report's reliability. For defenders, the key is not to depend solely on AI providers' safeguards, but to protect externally exposed systems, manage credentials including API keys and signing keys, and build a response posture that assumes a breach.