The most revealing artifact in Straiker’s investigation was not a piece of malware. It was a database.
The security firm obtained a snapshot of it, dated Sept. 24, taken from systems belonging to a criminal group it tracks as CyberCartel and designates AiPT-67. The file held 4,493 records: 2,911 email addresses, 903 account numbers, 391 API keys and 67 passwords stored in plain text. That is not the shape of a break-in. It is the shape of an inventory.
Straiker published its findings on Oct. 21, describing a multi-agent attack system the group calls CARLIY0S. The framework sits on top of PentAGI, an open-source automated security-testing tool, and coordinates several commercial and open models in specialized roles. Agents built on Anthropic’s Claude drafted exploit code, ran reconnaissance and made targeting decisions, with one model proposing an approach and another reviewing it and returning a verdict. Models from xAI’s Grok line were used to harvest credentials at volume into a database the operators named FinancialSoft. Moonshot’s Kimi models were also part of the stack, including as a fallback when other systems declined a request.
The plumbing is where the design shows. CARLIY0S drove automated browsing through Playwright and routed traffic through residential proxies, configured so that requests appeared to originate in Mexico. Operators framed their requests to the models as authorized testing or academic research, a technique intended to keep the systems cooperative.
Over several months, according to the report, the operation pointed at more than 400 banks, payment processors and other financial institutions across Latin America. The system could take passwords and customer data, connect to bank accounts and move through the stages of an intrusion with almost no human input. The work that once required a crew with distinct skills was consolidated into a pipeline that a small group could supervise.
Two cautions belong with those numbers. Straiker’s report describes an investigation of the group’s own systems, not forensic proof that each of the 400-plus targets was breached; the firm did not name the institutions. And the record count describes what the operators had collected, which is a measure of ambition as much as of success.
Researchers linked the activity to operators working as the Tr4nsHack Team under the name Hexagon Security Labs Mexico. Their tooling included a dashboard for tracking victims, the kind of interface that turns intrusion into a managed process with queues and statuses.
What makes the case notable is not that criminals used chatbots. It is the division of labor. Each model was assigned a function, and the framework handled the handoffs — reconnaissance output becoming a target list, a target list becoming an exploit attempt, an exploit attempt becoming a credential in a table. The vulnerability that a security team patches is technical. The vulnerability this describes is organizational: a small group can now buy, rent or prompt the capabilities of a much larger one.
The economics follow. Intrusions have always scaled with headcount, which is why financial institutions built defenses calibrated to the pace of human attackers — rate limits, anomaly thresholds, call-back verification, the assumption that a fraud attempt costs the criminal time. An agent that can attempt ten thousand logins while its operator sleeps changes the cost side of that equation without changing the defense.
The target set explains the method. Banks, payment processors and fintechs sit behind login pages and APIs that were designed to be reachable, and much of the region’s financial sector has spent a decade moving customers onto digital channels faster than it has moved security spending. An automated system does not need a novel flaw to be useful against that surface. It needs volume, patience and a proxy pool.
Model providers have policies against this use, and the report shows what those policies are worth in practice: a request framed as authorized testing, a refusal from one system, and a substitute model that complies. The firms that build the agents can detect some of this through usage patterns, but they see prompts, not outcomes. The bank sees outcomes and not prompts.
That asymmetry is the policy problem nobody has assigned an owner to. Banks can harden authentication and watch for automated traffic. Model providers can restrict access and monitor for abuse. Neither can see the whole pipeline, and the customer whose account number sits in a table of 903 does not care which layer failed.
Straiker’s disclosure arrives as the components behind this kind of system — an open-source testing framework, a handful of commercial models, a browser driver and a proxy service — remain freely available to anyone with a payment method. The technical barrier to replicating CARLIY0S is low; the report is essentially a blueprint with the serial numbers filed off.
The open question is not whether AI agents will be used at this scale, since they already are. It is whether the companies selling the models can be made responsible for noticing when their most capable customers are not customers at all.
