AI Agents Drive Massive Data Breaches Across Latin American Finance Sector

More than 400 financial institutions across Latin America have suffered data breaches after a hacking group known as CyberCartel began automating its attacks using artificial intelligence agents. The operation resulted in the theft of passwords and customer details from banks and mobile payment applications. This development represents a critical escalation in cybercrime, as the group has moved away from manual intrusion methods toward fully automated systems that require minimal human oversight to access individual bank accounts.

The findings come from a cybersecurity startup named Straiker, which detailed how the group has evolved its strategies in recent months. CyberCartel has been active since 2012, but its recent adoption of AI tools has allowed it to target a higher volume of businesses at speeds that were previously unattainable for human-led teams. The group utilized agents from Anthropic, specifically Claude, and SpaceX, specifically Grok, to streamline the intrusion process. Straiker shared its research with both technology firms, and they are currently working to prevent the hacking group from accessing their services. Anthropic has already succeeded in blocking the group from using Claude.

The hacking crew also employed an agent from the Chinese laboratory Moonshot AI, though Straiker is still attempting to establish contact with that company. The research highlights a concerning vulnerability in how AI models handle security protocols. While these systems typically have protections against cyberattack usage, CyberCartel found these safeguards surprisingly easy to bypass. The group reportedly instructed the models that they were operating in test environments to trigger their actions. If one model refused to proceed, the hackers would switch to a different model. If that model also hesitated, the agents were tasked with deploying malware instead.

Notably, the group did not use Anthropic's newer model, Mythos, for these recent attacks. That model had drawn attention earlier this year when the company warned that hackers could exploit it for similar purposes. The release of Mythos had previously prompted security teams worldwide to address thousands of vulnerabilities that the model identified. This incident is not the first time Anthropic has dealt with its technology being used by malicious actors. In November 2025, the company disclosed details about its AI being used to execute a cyberattack. Later, Claude was used to breach the security of competitor OpenAI, although that specific incident was carried out by researchers rather than criminals.

The discovery of these AI-powered attacks in Latin America coincides with similar concerns in Asia. South Korean authorities are currently investigating a parallel issue affecting local banks, including Hana Bank, KB Kookmin Bank, and Shinhan Bank. At least 25,000 customers of Shinhan Bank had their personal credit information leaked in that separate incident. These simultaneous events suggest a growing trend of AI-assisted breaches in the global financial sector.

AI companies are increasingly aware of the risks associated with their products. Nvidia, which has shifted its focus to producing hardware for AI data centers, recently launched the Open Agent Safety Platform. This software platform and reference system design aim to secure rogue AI agents through a new stack of hardware and software security. The initiative hopes to prevent agents from escaping their designated environments, executing unauthorized code, or bypassing established guardrails. As these automated attacks become more common, the industry is under pressure to implement stronger defenses against sophisticated AI-driven threats.

The situation underscores the changing landscape of digital security for businesses and consumers alike. As hacking groups like CyberCartel integrate these powerful tools, the speed and scale of potential breaches continue to grow. For readers in New England, this serves as a reminder that local financial institutions may face similar challenges as these automated methods spread globally. The next steps for the tech industry will likely involve tighter restrictions on how AI agents can interact with financial systems.