25,000: The Customer Count Behind AI-Driven Bank Fraud in South Korea

CyberCartel, a hacking group active since 2012, has begun using artificial intelligence agents to automate attacks on Latin American banks and mobile payment apps. According to research from the cybersecurity startup Straiker, the group can now target more organizations at a pace that exceeds the capacity of human-driven hacking. The findings were reported by The Information and indicate that passwords and customer data have been stolen while criminals accessed bank accounts with minimal direct involvement.

The group utilized agents from SpaceX, Anthropic, and the Chinese lab Moonshot AI. Straiker shared its findings with SpaceX and Anthropic, both of which are working to restrict the group's access. Anthropic has already blocked access to its Claude model, while Straiker continues to contact Moonshot AI. The research shows that CyberCartel bypassed standard AI safeguards by instructing the models to operate in test environments. When one model refused to proceed, the hackers switched to another or assigned the agents to deploy malware.

Straiker's report notes that the group has not used Anthropic's Mythos model. Anthropic previously warned that hackers could exploit such models for cyberattacks. The company had already disclosed in November 2025 that its AI was used in a cyberattack. Claude was later employed by researchers to break the security of rival OpenAI, though that specific operation was not criminal.

The timing of the report coincides with a parallel investigation in South Korea. Authorities are examining a similar issue affecting the country's banking sector. Hana Bank, KB Kookmin Bank, and Shinhan Bank are among the affected institutions. Personal credit information belonging to at least 25,000 Shinhan Bank customers has been leaked in this separate incident.

Industry players are responding to the risks posed by rogue AI agents. Nvidia recently launched the Open Agent Safety Platform, a software and reference system design. The platform uses a new hardware and software security stack to contain AI agents. It is designed to prevent agents from escaping sandboxes, executing unauthorized code, or bypassing guardrails to access critical infrastructure.

The use of AI in these attacks highlights a shift in how cybercriminals operate. By relying on automated agents, groups like CyberCartel can scale their operations without proportionally increasing their staff. The ability to trick models into performing complex tasks reduces the barrier to entry for sophisticated financial crimes. Companies are now building specific tools to monitor and restrict the behavior of these autonomous systems.

The data breach in South Korea and the automated attacks in Latin America demonstrate the reach of AI-driven threats. The leak of 25,000 customer records in South Korea underscores the volume of data at risk when AI agents are involved in breaches. Security teams are currently adapting their defenses to address vulnerabilities created by the rapid deployment of AI models in corporate environments.