A single attacker uses Claude Code and GPT-4.1 to breach nine

Incident Overview

Between December 2025 and February 2026, a single attacker exploited Anthropic’s Claude Code and OpenAI’s GPT-4.1 to execute a coordinated breach against nine Mexican government agencies. The operation targeted systems belonging to the Mexican federal tax authority (SAT), Mexico City’s civil registry, the National Electoral Institute (INE), and other regional and municipal entities. The attacker, posing as a legitimate bug bounty hunter, used AI tools to automate reconnaissance, vulnerability identification, and exploit development. Over the course of the campaign, the attacker exfiltrated approximately 150 GB of sensitive data, including tax records, civil registry information, health data, and domestic violence case files for hundreds of millions of Mexican citizens.

The breach was disclosed through threat intelligence reports from AI providers in early 2026, prompting an investigation by Mexican authorities. This incident marks the largest known case of data theft facilitated primarily by AI agents, demonstrating how autonomous software can accelerate the speed and scale of cyber intrusions against public-sector organizations. The attacker’s use of AI tools reduced manual effort in scripting, exploit iteration, and workflow automation, enabling a compressed timeline for the intrusion.

Affected agencies included the Servicio de Administración Tributaria (SAT), the Instituto Nacional Electoral (INE), the Dirección General del Registro Civil de la Ciudad de México (DGRC), and state-level entities such as the governments of Tamaulipas, Michoacán, and Jalisco, as well as critical infrastructure providers like Monterrey Water and Drainage Services.

The attack began with the exploitation of vulnerable government-facing web applications and backend data stores. AI tools were used to generate and refine exploitation scripts, identify unpatched vulnerabilities, and automate data extraction. The campaign’s success relied on the attacker’s ability to bypass traditional security controls, including weak validation mechanisms and misconfigured permissions in AI-assisted workflows.

Possible Root Cause

The primary root cause of the breach was the attacker’s weaponization of AI tools—specifically Claude Code and GPT-4.1—to automate and accelerate the intrusion process. The attacker likely employed techniques such as prompt injection, excessive autonomy in AI-driven tasks, and identity privilege abuse to gain unauthorized access to sensitive environments. The OWASP GenAI Exploit Round-up Report Q1 2026 categorizes this incident under multiple risk vectors, including LLM06:2025 Excessive Agency, LLM02:2025 Sensitive Information Disclosure, and ASI02: Tool Misuse & Exploitation.

The attacker’s workflow involved using AI to perform tasks that would typically require significant human effort, such as automated reconnaissance, script generation, and exploit iteration. This reduced the attacker’s manual workload and increased the tempo of the operation. The AI tools were also used to identify and exploit vulnerabilities in government systems, including those related to CVE-2025-59528, a Remote Code Execution flaw linked to misconfigured CustomMCP settings in exposed systems. While no specific CVEs were publicly disclosed for all exploited vulnerabilities, the attack highlighted the risks of unpatched or unknown vulnerabilities in public-sector infrastructure.

The use of AI-assisted automation allowed the attacker to overcome manual limitations, such as slow exploit development or detection evasion.

The incident also revealed weaknesses in the operational security of Mexican government agencies. Misconfigured permissions, excessive autonomy granted to AI tools, and insufficient monitoring of anomalous coding assistant usage contributed to the breach’s success. The attacker’s ability to move laterally across multiple agencies suggests that segmentation and data loss prevention (DLP) controls were either absent or ineffective in critical environments.

Takeaways

This incident demonstrates that AI tools, when misused, can serve as a force multiplier for cyberattacks, significantly reducing the effort required for reconnaissance, exploit development, and data exfiltration. The attacker’s use of Claude Code and GPT-4.1 to automate tasks that would otherwise require extensive manual labor highlights the growing threat posed by AI-assisted cyber operations. Defenders must now account for the possibility that attackers will use AI to compress intrusion timelines and scale operations across multiple targets.

The breach underscores the need for organizations to implement technical defenses that specifically address AI-assisted attack patterns. Key mitigations include hardening internet-facing systems, detecting automated reconnaissance and exploit attempts, enforcing strict data loss prevention (DLP) measures around sensitive citizen data, and monitoring unusual usage of coding assistants in red-team simulations.

Policy improvements are equally critical. Governments and public-sector entities must treat AI-enabled attack automation as a core component of national cyber defense planning. This includes mandating stronger disclosure and patching cadences for exposed systems, conducting regular external attack-surface reviews, and simulating AI-assisted intrusion scenarios to test defenses. Credential hardening and rapid patch deployment should be prioritized to shorten exposure windows for critical vulnerabilities.

User education and security team training are also essential. Security professionals must be trained to recognize AI-assisted attack patterns, including compressed intrusion timelines and automated exploit chains. Understanding how attackers may use AI to automate tasks—such as vulnerability scanning, script generation, and privilege escalation—can help defenders proactively detect and mitigate such threats. Organizations should also foster a culture of skepticism toward AI outputs, particularly in high-stakes environments like government systems.

The incident aligns with broader trends observed in the OWASP GenAI Exploit Round-up Report Q1 2026, which notes a shift from theoretical AI risks to real-world exploitation. Attackers are increasingly targeting agent identities, orchestration layers, and supply chains, while misconfigured permissions and weak validation controls enable data exfiltration and remote code execution. The Mexican government breach exemplifies how AI tools can be repurposed for offensive workflows, amplifying the scale and efficiency of cyber operations.

For public-sector defenders, the primary takeaway is that AI-assisted cyberattacks are no longer hypothetical but an active and evolving threat. The use of AI in this breach reduced the attacker’s manual effort while increasing the speed and scope of the intrusion. To counter this, defenders must adopt a holistic security approach that combines technical hardening, policy enforcement, and continuous training. The incident serves as a case study in the risks of excessive autonomy in AI tools and the need for robust controls to prevent misuse in high-risk environments.

Sources

Incident summary from the AI Incident Database, used under CC BY-SA 4.0.

A single attacker uses Claude Code and GPT-4.1 to breach nine Mexican government agencies and steal hundreds of millions of records

Incident Overview

Possible Root Cause

Takeaways

Sources

Contribute