Mexico: attacker wears down Claude to breach government systems

The chain

The report, the responsible party’s response, the fix they claimed, whether anyone independent checked, and where it stands. A company saying it fixed something and evidence that the fix worked are different rows.

1. Reported Feb 25, 2026

   Gambit Security published a report (Feb 25) based on forensic materials it says it recovered from three servers used in the campaign, including 1,088 logged attacker prompts and 5,317 AI-executed commands, concluding that a single operator posing as a bug-bounty researcher used Claude (and at times ChatGPT) over about a month to take roughly 150 GB from the SAT tax authority, the INE electoral institute, Mexico City's civil registry and several state governments. Bloomberg reported it the same day. source

2. Response Feb 26, 2026

   Anthropic said it looked into the claims, disrupted the activity and banned the accounts; OpenAI said 'We have banned the accounts used by this adversary' and that its tools refused. The SAT said it analyzed its logs and 'no identificó accesos ilegítimos ni comportamiento anómalo'; the INE 'rechaza categóricamente' any breach and said the claim rests on a private firm's statements 'sin que hasta el momento haya evidencia técnica pública verificable'; Jalisco denied a breach; Michoacán, Tamaulipas and Mexico City's civil registry did not respond. source

3. Claimed fix Feb 25, 2026 partial

   Anthropic's stated remedies are account bans, feeding misuse examples back into training, and a claim that Claude Opus 4.6 'includes probes that can disrupt misuse'; OpenAI banned accounts. No Mexican agency announced a remediation, investigation or breach notification. source

4. Independent check Feb 26, 2026 none

   No independent verification found of either the breach or the guardrail fix: Gambit has not published the stolen data, no Mexican authority has confirmed or publicly investigated, and no outside party has tested whether Claude still yields to the 'worn-down' pretext. The OECD AI Incidents Monitor logs it as an incident on the strength of the report and expert analysis despite the denials. source

5. Where it stands Feb 26, 2026 disputed

   Eight months on, the security firm stands by its forensic evidence, two named agencies deny any breach, the rest are silent, and nothing new has been published since February. source

What would change the verdict

Leaked data surfacing (or a Mexican forensic or INAI finding) would confirm the breach; a Gambit retraction or a verified clean audit of SAT and INE would deflate it.