What happened
Selecting attack options, coordinating execution and collecting secrets through a multi-model offensive framework
2026-10-21
HighPrimaryCyberCartel Used a Multi-Model Agent System to Coordinate Financial-Sector Attacks
Straiker reports that CyberCartel operators built CARLIY0S on PentAGI with a Claude commander, role-specialized model debate and an arbiter, plus Grok.
CARLIY0S / PentAGIGovernance bypassReported agent authority-boundary failureExternally operated multi-agent framework and financial service access boundaries
Why it matters
Researcher-observed stolen access material and financial-sector operations; no independently verified total of successful bank breaches or monetary loss.
Missing authorization check
Independent authorization for selecting attack options, coordinating execution and collecting secrets through a multi-model offensive framework
Would PP block it?
An independently enforced gate in the agent operator's own environment could bind consequential actions to an approved target and task. That is a deployment condition, not protection supplied to an unwilling third-party target.
Incident analysis
Timeline and technical read
Timeline
2026-10-21
The cited source discloses the behavior documented in this record.
Technical breakdown
- Straiker reports that CyberCartel operators built CARLIY0S on PentAGI with a Claude commander, role-specialized model debate and an arbiter, plus Grok collection and shared MCP state. Its investigation of the operators' environment found a stolen-credential database with 4,493 records and documents showing financial-sector targeting across Latin America. Straiker reports operational collection and attack coordination, but configuration alone does not prove every listed model ran or that every target was breached.
- Selecting attack options, coordinating execution and collecting secrets through a multi-model offensive framework
- Researcher-observed stolen access material and financial-sector operations; no independently verified total of successful bank breaches or monetary loss.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Externally operated multi-agent framework and financial service access boundaries
- Still needs
- PP is not a perimeter defense and cannot stop an outside agent using its own tools or stolen credentials against an unintegrated service. Patching, identity controls, isolation and network restrictions remain necessary.
- Receipt required for
- Selecting attack options, coordinating execution and collecting secrets through a multi-model offensive framework
An internal gate at the affected organization cannot constrain an externally operated agent that does not route its actions through that gate.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.