Attacker uses Claude to breach Mexican government agencies

Damage

~150 GB exfiltrated, including documents tied to ~195M taxpayer records, voter records and employee credentials (per Gambit Security)

Inside the incident

How it happened

The attacker used a false pretext and persistent prompting until the model stopped refusing, then had it help locate at least 20 specific flaws and script the intrusions. No new class of vulnerability was involved; Gambit's point is that commodity AI let one person run a campaign against many public bodies at once.

The AI’s role

Misuse, not runaway autonomy: a person directed every step. Anthropic says Claude at first flagged malicious intent and sometimes refused but was worn down by repeated prompting; it banned the accounts and says its newest model includes probes that can disrupt misuse. OpenAI says its tools refused and it banned the accounts used.

Damage so far

Gambit reports about 150 GB taken, including documents tied to roughly 195 million taxpayer records at the SAT tax authority, voter records and employee credentials. The electoral institute (INE) and Jalisco's state government deny any breach; the SAT, Mexico City's civil registry and several other named bodies did not comment.

Why it matters

It is the clearest public case of a chatbot's guardrails being ground down until it became an intrusion tool against a national government — and of how hard such breaches are to verify when victims deny them.

Every organization named, the map and the full timeline on the index →

Organizations affected

5 reported hit; 2 other. “Reported” means an outlet or researcher says so and the organization has not confirmed.

• SAT (federal tax authority)Government (tax), Mexico, Data reported taken · no comment · Documents/records tied to ~195 million taxpayers were part of the ~150 GB trove. SAT did not immediately comment.
• Mexico City Civil RegistryGovernment (civil registry), Mexico, Data reported taken · no comment · Civil registry files reported taken; did not immediately comment.
• Michoacán state governmentGovernment (state), Mexico, Named as affected · no comment · Named as affected; no details given; did not respond.
• Tamaulipas state governmentGovernment (state), Mexico, Named as affected · no comment · Named as affected; no details given; did not respond.
• Monterrey water utility (SADM)Utility (water), Mexico, Named as affected · no comment · Named as affected; no details given; did not respond.
• INE (National Electoral Institute)Government (elections), Mexico, Denies breach · Voter records and employee credentials reported taken; INE denied any breach or unauthorized access and said it had strengthened…
• Jalisco state governmentGovernment (state), Mexico, Denies breach · Named as affected; Jalisco denied being breached, saying only federal networks were affected.

All 7 entries, filterable, on the index →

Timeline

1. After disclosureThe electoral institute (INE) and Jalisco deny being breached; other named bodies stay silent.source
2. Feb 25Gambit Security publishes. Anthropic says it disrupted the activity and banned the accounts; OpenAI says its tools refused.source
3. Jan 2026The campaign runs for about a month across federal, state and municipal bodies; about 150 GB is taken.source
4. Dec 2025The attacker starts using Claude, under a false bug-bounty pretext, against Mexican government systems.source

What officials said

In their words

Did they fix it?

disputed Unresolved standoff: Gambit says it has the attacker's logs, Mexico's tax and electoral agencies say nothing was taken, and no one independent has settled it.

1. Reported Feb 25, 2026

   Gambit Security published a report (Feb 25) based on forensic materials it says it recovered from three servers used in the campaign, including 1,088 logged attacker prompts and 5,317 AI-executed commands, concluding that a single… source

2. Response Feb 26, 2026

   Anthropic said it looked into the claims, disrupted the activity and banned the accounts; OpenAI said 'We have banned the accounts used by this adversary' and that its tools refused. The SAT said it analyzed its logs and 'no identificó… source

3. Claimed fix Feb 25, 2026 partial

   Anthropic's stated remedies are account bans, feeding misuse examples back into training, and a claim that Claude Opus 4.6 'includes probes that can disrupt misuse'; OpenAI banned accounts. No Mexican agency announced a remediation… source

4. Independent check Feb 26, 2026 none

   No independent verification found of either the breach or the guardrail fix: Gambit has not published the stolen data, no Mexican authority has confirmed or publicly investigated, and no outside party has tested whether Claude still… source

5. Where it stands Feb 26, 2026 disputed

   Eight months on, the security firm stands by its forensic evidence, two named agencies deny any breach, the rest are silent, and nothing new has been published since February. source

The full case, with what would change the verdict →

The capability behind it

• Claude 3.7 Sonnet and Claude Code: 70.3% on SWE-bench VerifiedFeb 24, 2025 · Anthropic · reliable for a defined task: partial