Security firm Straiker published an investigation this week into a system it calls CARLIY0S, built by the group known as CyberCartel, and says the evidence came from the criminals’ own working environment rather than from watching model traffic.
The architecture is the story. Four Claude instances were assigned fixed roles: one planned execution, one scouted, one looked for lateral openings, and a fourth arbitrated. Targets were debated and a single decision came back before anything ran. A commander session inside the Cursor editor drove the whole loop.
Grok made up the collection side. Straiker describes five Grok miners that fed a stolen-credential database of 4,493 records, including payment-rail logins and hundreds of API keys. When Kimi refused an offensive request, the orchestrator fell back to a local file of pre-written exploit code.
The group took care to defeat attribution. Rule files barred the models from writing the crew’s own handle, so model output would not tie back to them. Requests were framed as authorised red-team exercises, a framing Straiker says reliably defeated safety policies.
Straiker counted more than 400 financial targets across Latin America. Anthropic revoked the credential that reached Claude after being notified, and xAI said it was looking into the Grok activity.
The uncomfortable finding is that the models behaved like a team with roles and review, not like a search box. Defenders who plan for a single prompt are reasoning about last year’s threat.
