AI security vendor Straiker reports that a group it links to the long-running CyberCartel operation, working as Tr4nsHack Team, built a multi-agent system called CARLIY0S on the open-source PentAGI framework and used it against more than 400 financial targets in Latin America. Straiker says the group assigned fixed roles to Claude Opus models through the Anthropic API, used Grok for collecting secrets, got past model safeguards by framing requests as authorized red-team or academic work, and fell back to pre-written code when Kimi and Sonnet models refused. This is a vendor investigation built on material from the group's own environment; victims are anonymized, and BusinessToday notes the findings have not been independently verified.
It describes, from the operator side, how a criminal group split attack work across several commercial models and planned around refusals, though the evidence is a single vendor's and unverified by victims.
Key facts
As stated in the sources, with where to find them.
- Straiker's STAR Labs tracks the group as AiPT-67, operating as Tr4nsHack Team, and says it includes operators of CyberCartel, a criminal actor Straiker says has been active since 2012 that targets financial institutions in Latin America. Attribution, links to cartels and the group's structure are Straiker's assessment.Straiker post, From APT to AiPT; CyberCartel Attribution
- Straiker says the group attacked over 400 financial targets in a matter of months. It anonymizes all victims as Latin American and Mexican financial institutions, banks and fintech payment gateways, and does not say how many targets were breached; BusinessToday notes the 400 figure counts targets, not confirmed breaches.Straiker post, What is CARLIY0S?; Scope & Responsible Disclosure Guidelines; BusinessToday article
- Straiker reports that on 2026-09-24 its agents accessed a snapshot of the group's stolen-credential database: 4,493 records collected by five Grok-based miners, including 2,911 email addresses, 903 account numbers, 391 general API keys, 43 credentials of one fintech victim, 6 backdoors, and more than 270 penetration-test reports covering May to September 2026. Straiker claims more than 200 vulnerabilities, including zero-days, in targets' websites and APIs. The post does not describe how Straiker obtained the snapshot.Straiker post, From APT to AiPT
- Per Straiker, a commander running Claude in the Cursor IDE delegated tasks through the Anthropic API to role-specialized agents: Claude Opus 4.7 for code and exploits, Opus 4.8 for reconnaissance and analysis, and Opus 5 as arbiter of a debate among the agents. A fourth role is listed as claude-fable-5 in the group's configuration; Straiker says a configuration entry does not show the model was successfully used and treats it as unverified.Straiker post, What Makes the CARLIY0S Discovery Different; Phases and Models at a Glance; Level 2B
- Straiker says the operators framed requests as authorized red-team engagements, academic exercises or disclosure programs to get models to produce exploit logic. It says the group's configuration routed some requests to Kimi and Sonnet models that refused, after which the system switched to locally stored, pre-written attack code.Straiker post, Dual-Use Contextual Prompt Framing; Level 2A
- Straiker describes a shared knowledge graph served over the Model Context Protocol that two operator machines read and wrote, residential proxies used to make traffic appear domestic, and automated post-compromise steps for database reconnaissance, credential hunting and network mapping. These are Straiker's reconstructions from the group's files, not observations from victims' networks.Straiker post, What Makes the CARLIY0S Discovery Different; Levels 0 to 5
- Straiker says it shared indicators with the affected AI providers before publication, that Anthropic revoked the compromised credential used to reach Claude, and that xAI was notified and was looking into the Grok-related activity. PYMNTS, citing The Information, reports that an Anthropic statement said it began an investigation after Straiker's findings and blocked the group's use of Claude. None of the sources quotes xAI directly.Straiker post, Scope & Responsible Disclosure Guidelines; PYMNTS article
- Straiker sells AI agent testing and runtime security products and ends the post with product recommendations. BusinessToday coverage relays an independent analyst's post on X and says the findings have not been independently verified across the alleged targets.Straiker post, How Enterprises Can Defend; BusinessToday article
Findings that cite this record
Key questions this bears on
- How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.