AI agent swarm hit 400 Latin American banks amid 48-hour exploit storm
新智元 · wechat · 2026-10-23
A roundup of a 48-hour burst of 27 major vulnerabilities: two CVSS 9.2 PHP2Shell flaws in PHP, a malicious LiteLLM PyPI/Docker release (3.4M daily downloads), and eMudhra CA key leakage. Standout: CyberCartel's CARLIY0S multi-agent attack system used Claude as strategist and Grok as credential-harvesting executor, disguised as red-team exercises, compromising 400+ Latin American banks and 4,500 high-value credentials. Axios also reports Wall Street banks scrambling over unauthorized third-party AI agents operating inside customer accounts.
More from Safety
- Super-Worms Warning: AI-Powered Self-Propagating Malware and a Fragmenting Internet — JensHonack · 2026-10-23
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Sanders calls to pause autonomous AI agents in bank accounts; critics push back — AIandDesign · 2026-10-23
- TechPolicy essay: system prompts are weak evidence of AI safety, outputs must be evaluated — mmitchell_ai · 2026-10-23
- Anthropic's deputy security chief warns cyber threats will get 'a lot worse before they get better' — Polymarket · 2026-10-23
- AI cyberattacks could paradoxically accelerate AI development in an offense-defense arms race — kimmonismus · 2026-10-23