Straiker describes an AI-assisted operation targeting more than 400 financial organizations in Latin America

What the investigation says about CARLIY0S

On October 21, 2026, Straiker published an investigation into CARLIY0S, a system that the company says was used by operators associated with CyberCartel to coordinate activity against more than 400 financial targets in Latin America. The investigation describes banks and payment providers among the types of organizations targeted. That figure refers to targets; it does not show that more than 400 institutions were successfully breached.

Straiker says its investigation was based on access to a snapshot of systems and working materials attributed to the group, including configuration files, scripts, infrastructure and a database called FinancialSoft. This is direct evidence of what was present in that environment, but the report does not independently verify every attack or identify the organizations involved. The attributions and scope should therefore be understood as the company’s findings, not as public confirmation of responsibility or damage at each institution.

Coverage of the case also highlights this limitation: the banks were not named, and it is not possible to establish publicly which institutions in the region may have suffered an intrusion. The available material also provides no verifiable list connecting each of the more than 400 targets to successful access, data theft or financial losses.

A chain of tools, not a single autonomous agent

Straiker describes CARLIY0S as a distributed setup combining human operators, scripts, security tools and commercial models. The system allegedly relied on PentAGI, an automated security-testing framework, and components for sharing information and delegating tasks. It is more accurate to describe it as an AI-assisted, coordinated operation than as an agent acting on its own.

The report attributes different functions to several models. Claude appears in a multi-agent configuration for tasks such as analysis, code generation and evaluating alternatives; one model reportedly coordinated activity through Cursor. Grok is associated with gathering and classifying information, while Kimi appears in fallback configurations. Configuration records alone do not prove that every model ran successfully at every stage or against every target.

The report also describes conventional tools for automating web interactions, analyzing traffic and synchronizing data between machines. Models could contribute analysis or suggestions, but access to systems and execution depended on tools, credentials, scripts and infrastructure. The actual capability of each stage cannot therefore be inferred solely from the presence of an AI configuration.

What the records show—and what they do not establish

The snapshot Straiker says it reviewed contained 4,493 records in FinancialSoft. The description includes financial-account data, email addresses, passwords, API keys and other sensitive material. Published counts include 2,911 email addresses and 903 account numbers. These are figures attributed to the inventory examined, not a measure of people affected or confirmation that every record was valid or used.

The report also mentions credentials associated with payment infrastructure, including information that could relate to SPEI, Mexico’s interbank payment system. Exposed credentials can increase the risk of unauthorized access or fraud, but they are not enough to demonstrate that transfers took place, that customer accounts were accessed or that the credentials were still active.

The company says it anonymized the organizations and sanitized sensitive material in its publication. As a result, readers cannot verify the entities’ identities or publicly check the status of each account or key mentioned. The quantity and nature of the records warrant defensive attention, but should not be turned into a claim of specific financial losses.

Provider responses and the scope of the measures

Straiker says it shared relevant indicators with model providers. According to the company, Anthropic revoked a compromised credential used to access Claude. Straiker also said that xAI had been notified and was examining activity associated with five “Grok miners.” These measures concern access to specific services; they do not prove that all infrastructure attributed to the group was disabled.

The material provided does not document specific measures taken by Latin American banks to block AI agents, nor does it identify institutions implementing particular controls. It is therefore not possible to say that banks across the region introduced a general ban on third-party agents in response to this case. That question should be distinguished from preventive restrictions reported in other markets, which do not establish how Latin American institutions responded.

From a defensive perspective, the case points to areas organizations can review: exposed credentials, API permissions, access to administrative portals, unusual activity and connections to external services. These are relevant lines of defense against access and automation risks, not a guarantee of detection or a list of measures confirmed to have been implemented by the banks involved.

What changes—and what does not—for AI security

The case is significant even without evidence that a model acted with general autonomy. The investigation describes a combination of commercial models, automated tools, scripts, shared infrastructure and human operators. That combination may help organize tasks and expand an operation’s reach, but the report does not establish that AI replaced the attackers or independently chose and carried out every action.

Straiker’s evidence is a case study based on materials the company attributes to the operators’ working environment. It is not, by itself, an independent measure of how often agents are used in attacks, nor does it show that the same architecture would produce equivalent results for other groups or sectors. A model configuration is not proof that the model generated a successful intrusion.

The practical takeaway is narrower: financial institutions should account for the possibility that AI tools may be part of offensive workflows already supported by conventional software and infrastructure. The response is not limited to blocking a model; it also requires protecting credentials, restricting permissions, monitoring account and API behavior, and verifying incidents against technical logs. The available sources do not establish a new regulatory measure or a common policy among Latin American banks.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.