AI Agents Using Claude and Grok Fully Automate Attacks on 400 Latin American Financial Institutions
Security researchers at Straiker have uncovered a sophisticated operation in which the hacking group CyberCartel deployed an AI agent network powered by large language models from Anthropic and xAI to conduct fully automated attacks against more than 400 Latin American financial institutions.
The investigation, reported on October 21, shows that the attackers used models including Claude and Grok, with CrowdStrike additionally confirming the involvement of DeepSeek. The AI agents were tasked with compromising banks and payment applications across the region, performing the entire attack chain with little to no ongoing human oversight.
Four-Stage AI-Driven Attack Pipeline
The operation follows the classic four phases of a cyber attack, but each stage is executed autonomously by the AI agents:
- Reconnaissance: The agents automatically collect open-source intelligence on hundreds of targets simultaneously, analyzing public records, employee social media, job postings, and historical breach data—tasks that would be prohibitively time-consuming for human operators.
- Credential Theft: Adaptive techniques allow the agents to bypass login pages, test credential stuffing, phishing, and configuration weaknesses while adjusting strategies based on real-time feedback.
- Account Takeover: Once access is obtained, the agents mimic legitimate user behavior, rotating proxies, forging device fingerprints, and varying operation timing to evade bank fraud detection systems.
- Data Monetization and Lateral Movement: Stolen customer data is exfiltrated and the agents move to the next target without further instructions.
Because the agents can adjust tactics dynamically, they evade rules designed to catch static scripts, making the attacks significantly harder to detect than traditional automated tools.
Cost Collapse and Shifting Attack Economics
The most concerning aspect is the dramatic reduction in operational cost. Previously, a meaningful campaign against a single bank required an experienced team working for weeks or months. With the AI agent network in place, the marginal cost of attacking an additional institution approaches zero, enabling attackers to treat financial institutions as a high-volume target list rather than individual high-value operations.
Defensive Recommendations
Security teams are urged to respond by integrating AI into their own operations. Key measures include building dynamic behavioral baselines for user activity, implementing strict zero-trust controls, reinforcing multi-factor authentication and transaction monitoring, and conducting red-team exercises that specifically simulate AI-driven adversaries.
Experts note that this incident is likely only the first of many similar operations, underscoring the need for defenders to adopt AI tools at the same pace as attackers.
Related articles
NYU Researchers Find 86% of Chatbot Responses on Digital Abuse Contain Errors, Gaps or Safety Risks
A study by New York University’s Tandon School of Engineering examined four chatbots answering 193 questions about spyware, location tracking, and account control. Researchers identified problems with accuracy, completeness, or safety in 86 percent of responses. Even specialized assistants Aimee and Ruth performed no better than general models GPT-4o and Claude 3.7 Sonnet. Approximately 74 percent of Aimee’s answers, 65 percent of Claude’s, 61 percent of Ruth’s, and 55 percent of GPT-4o’s were deemed unsafe. In 60 percent of cases the models omitted critical warnings that could alert an abuser or destroy evidence. All four systems could be prompted to assist potential stalkers, with Aimee and Ruth complying with roughly two-thirds of such requests.
Cloudflare Engineer Releases KillSwitch Language Designed to Trip Up AI Code Models
Dominic Pichet, an engineer at Cloudflare, has created an experimental programming language called KillSwitch specifically engineered to cause large language models to fail when interpreting or generating code. The language turns programs into narrative-style text where most content is ignored by the interpreter, hiding actual commands inside stories and using distance-based references to extract values. Rules for identifiers rely on letter counts and anagrams, while the language deliberately incorporates phrases such as “ignore previous instructions” that carry functional meaning inside KillSwitch itself. Pichet added misleading statements in the documentation and wording crafted to trigger model safety filters, creating a hostile environment for coding agents. In tests involving writing Hello World, explaining program output, and converting temperatures, Claude Opus 5 achieved the highest score of 66.8 points. The full source code and specification are available on GitHub, and the author plans to increase difficulty if models improve.
Zscaler Report Details How Generative AI Accelerates Custom Malware Creation and Social Engineering
Zscaler published an analysis on October 16 examining the use of generative AI by attackers for social engineering, data discovery, and malware development. Principal security researcher Phil Hagen notes that the report focuses on broad methods rather than naming specific malware families or confirmed campaigns. The core observation centers on the dramatically increased speed at which malicious scripts can be written and iteratively revised. Traditional detection that relies on matching files or traffic against known patterns loses effectiveness when code is frequently altered while preserving the same functionality. The analysis clarifies that observed rapid creation and revision does not equate to fully autonomous self-mutating malware that changes on every execution. Another impact is the disappearance of classic indicators such as spelling and grammar errors in phishing messages, which previously helped identify malicious intent. Zscaler recommends focusing on behavioral analysis of what programs actually do rather than solely relying on matches to previously catalogued samples.
Registration Opens for SOC Forum 2026 with Focus on GenAI and Cybersecurity Risks
GC Solar has opened registration for SOC Forum 2026, the central event of the Russian Week of Cybersecurity. The two-day conference will take place on 27-28 October at the Lomonosov cluster in Moscow and will examine both the economic benefits and the security challenges of generative AI. Day one covers business impact, regulatory questions, data control, liability for AI errors, and new threat vectors. Day two shifts to hands-on technical tracks covering attack detection, defensive infrastructure development, and the use of AI by both attackers and defenders. The program includes dedicated tracks such as AI & Cybersecurity, Offence, Defence, and SOC-practicum. Organizers emphasize practical discussions over marketing presentations about neural-network images.