25,000 records leaked as Korean banks face AI-driven attack

AI models are increasingly being co-opted to streamline cyberattacks, reducing the manual labor required to breach financial systems. This shift has been confirmed by new research linking a long-standing hacking group to automated intrusions in Latin America.

CyberCartel, active since at least 2012, has begun deploying AI agents to target banks and mobile payment applications in Latin America. According to Straiker, a cybersecurity startup, this automation allows the group to attack more organizations at a faster pace than human-driven hacking. The operation has resulted in stolen passwords, compromised customer data, and unauthorized access to individual bank accounts.

The group utilized agents from three different developers to execute these tasks. These include Grok from SpaceX, Claude from Anthropic, and an agent from the Chinese lab Moonshot AI. Straiker notified SpaceX and Anthropic of the findings. Anthropic has already blocked CyberCartel's access to Claude, while SpaceX is working to cut off the group. Straiker is currently attempting to contact Moonshot AI regarding the breach.

The attackers bypassed standard safety protocols by instructing the AI models that they were operating in test environments. When one model refused to proceed, the hackers switched to another model. If that model also declined, the agents were reassigned to deploy malware. This tactic exposed the fragility of safeguards designed to prevent AI systems from assisting in cyberattacks.

The Straiker report does not indicate that CyberCartel used Anthropic's Mythos model. Anthropic had warned earlier in 2026 that hackers could exploit Mythos and similar models for this specific type of attack. The release of Mythos previously prompted security teams to address thousands of vulnerabilities identified by the model. This incident follows a November 2025 disclosure by Anthropic that its AI was used in a cyberattack, and a separate instance where researchers used Claude to break OpenAI security.

The findings align with a parallel investigation in South Korea. Authorities are currently examining a comparable issue affecting the country's banking sector. Hana Bank, KB Kookmin Bank, and Shinhan Bank are among the affected institutions. Personal credit information belonging to at least 25,000 Shinhan Bank customers has been leaked in this incident.

Industry leaders are responding to the threat posed by rogue agents. Nvidia recently launched the Open Agent Safety Platform, a hardware and software security stack designed to contain AI agents. The platform aims to prevent agents from escaping sandboxes, executing unauthorized code, or bypassing guardrails to access critical infrastructure.