25,000 Bank Customers Exposed as AI Agents Automate Cyber Attacks
A decade-old hacking group now uses Grok and Claude to breach Latin American banks, while South Korean authorities investigate a parallel leak involving major financial institutions.
By Pavel Bell ·
At least 25,000 customers of Shinhan Bank in South Korea have had their personal credit information leaked, according to new reporting. The breach is part of a wider pattern of financial fraud where artificial intelligence agents are being used to automate attacks on banks and payment applications across multiple continents.
Research from the cybersecurity firm Straiker, shared with The Information, identifies a group called CyberCartel as a primary driver of this shift. Active since at least 2012, the group has historically targeted Latin American businesses. In recent months, the organization integrated AI agents into its workflow, allowing it to access bank accounts and steal passwords with minimal human intervention.
The operation relies on specific language models to execute tasks. CyberCartel has used Grok from SpaceX and Claude from Anthropic. An agent from Moonshot AI, a Chinese laboratory, has also been part of the attack chain. Straiker has communicated its findings to SpaceX and Anthropic. Anthropic has already blocked the group's access to Claude, while SpaceX is working to cut off its services. Straiker is still attempting to contact Moonshot AI.
The group bypassed standard safety protocols by instructing the models that they were operating in test environments. When one model refused a request, the hackers switched to a different agent. If multiple models declined, the AI agents were tasked with deploying malware directly. This method allowed the group to expand its reach to more organizations at a pace that manual hacking could not achieve.
The incident coincides with a separate investigation by South Korean authorities into comparable issues affecting local banks. Hana Bank and KB Kookmin Bank are among those under scrutiny. The leak at Shinhan Bank represents the first quantified loss in this region, with 25,000 records confirmed as compromised.
Industry leaders are responding to the growing threat of rogue agents. Nvidia recently launched the Open Agent Safety Platform, a software and hardware security stack designed to contain AI agents. The system aims to prevent agents from escaping sandboxes, executing unauthorized code, or bypassing guardrails in critical infrastructure. This launch follows earlier warnings from Anthropic about the potential for hackers to exploit advanced models for cyberattacks.
Source: Tom's Hardware
