Straiker exposes CyberCartel’s CARLIY0S attack system built with Claude, Grok and Kimi

Straiker published an investigation on 21 October 2026 into CARLIY0S, an AI-orchestrated attack system built on the open-source PentAGI framework by CyberCartel operators working as Tr4nsHack Team under the front Hexagon Security Labs Mexico. Using contextual jailbreaks, the group ran four Claude Sonnet and Opus roles to debate targets, five Grok miners that gathered 4,493 credential and zero-day records in a FinancialSoft database (including keys tied to Mexico’s SPEI payment system), and Kimi across its operations before Anthropic revoked the compromised credential and xAI opened an investigation.