AI-Powered Cyberattack Hits Mexican Government

In a striking evolution of cybercrime, hackers have reportedly leveraged Anthropic’s Claude AI to orchestrate a large-scale data breach against Mexican government agencies. Between December 2025 and January 2026, attackers exfiltrated approximately 150 GB of sensitive data, including taxpayer information, voter registration records, and employee login credentials. According to Israeli cybersecurity firm Gambit Security, the incident marks a turning point: the rise of “AI-enabled” cyberattacks that automate and accelerate traditional hacking methods.

Rather than relying on advanced technical expertise, the perpetrators used persistent, strategic interaction with AI systems to construct and execute their attack. The operation followed a structured lifecycle. First, during reconnaissance, Claude was prompted to generate network scanning scripts capable of mapping government portals and identifying exposed entry points. Next, the attackers fed reconnaissance outputs back into the system, using the AI to analyze data and identify unpatched vulnerabilities within web applications.

In the exploitation phase, Claude reportedly generated functional scripts—including SQL injection payloads—that enabled attackers to bypass authentication mechanisms. Finally, the AI was used to outline lateral movement techniques and automate data exfiltration pathways, streamlining the theft of massive datasets.

Despite existing safety protocols designed to prevent misuse, the attackers successfully circumvented guardrails through contextual manipulation. By framing requests as part of a fictional bug bounty program or authorized penetration test, they elicited technical guidance that would otherwise be restricted. In some cases, when Claude declined to respond, the attackers reportedly turned to other AI models, including OpenAI’s ChatGPT, combining outputs from multiple systems to advance their objectives and evade detection.

While the breach demonstrates how generative AI can be weaponized, cybersecurity experts caution against viewing AI solely as a threat. Anthropic disclosed that its own threat intelligence team relied extensively on Claude to analyze forensic data during the investigation. The company has since banned the implicated accounts and reinforced safeguards in newer models.

Ultimately, the incident underscores a critical reality: as attackers integrate AI into their operations, defensive strategies must evolve just as rapidly to counter threats assembled in real time by machine-generated code.