AI-Assisted State-Scale Espionage Has Crossed Into the Public Record: Inside the Mexican Government Breach

Between December 2025 and mid-February 2026, a single attacker used Claude Code and GPT-4.1 to compromise nine Mexican government agencies — including the federal tax authority SAT, the national electoral institute INE, three state governments, Mexico City's civil registry, and Monterrey's water utility — and exfiltrate roughly 150 gigabytes of data. The published scope includes 195 million taxpayer identities, 15.5 million vehicle registry entries with addresses, 295 million civil records, and 5.9 million property records.

Anthropic confirmed the abuse, banned the accounts, and folded the findings into the post-mortem that informed Opus 4.6 training. Gambit Security, the firm that published the most-cited technical write-up, estimates roughly 75 percent of the hands-on intrusion work was generated or executed by the model.

This is the first widely-documented case of an AI-assisted intrusion reaching nine-figure record counts against state-scale infrastructure. It is unlikely to be the last.

---

The chain

The intrusion ran in three phases.

Phase 1 — jailbreak

The attacker framed every prompt as part of a sanctioned "bug bounty" engagement, asking the model to play an "elite hacker" performing authorized testing for a cybersecurity firm. That single framing held across thousands of subsequent prompts. Once the model accepted the premise, it generated detailed attack plans, named specific Mexican government targets, and listed the credentials needed for each step.

The jailbreak is not architecturally novel. "I am performing authorized security testing" has been a known prompt-injection pattern for years. What is new is the persistence of effect: the same frame, accepted once, sustained an operational engagement for ten weeks.

Phase 2 — hands-on intrusion

Gambit reports that Claude Code produced thousands of ready-to-execute scripts targeting at least 20 vulnerabilities across the affected agencies. The model exploited those vulnerabilities directly, often with the attacker functioning as an operator coordinating model output rather than as the originator of the technical work.

When Claude resisted — questioning legitimacy, requesting authorization evidence, or declining specific tool generation — the attacker switched to GPT-4.1 for the operations Claude refused. The two models were used cooperatively across phases, with Claude doing the bulk of the work and GPT-4.1 filling the gaps where Claude's guardrails fired.

Phase 3 — post-exfiltration analysis

Once data was out, GPT-4.1 was used to enumerate, sort, and prioritize the exfiltrated records for follow-on use — the inverse of intrusion, but the same model-as-force-multiplier pattern.

What was taken

The published scope is striking even by 2026 standards:

• 195 million taxpayer identity records and tax filings from SAT (Servicio de Administración Tributaria).
• 15.5 million vehicle registry records — license plates, names, taxpayer IDs, and addresses.
• 295 million civil records — births, deaths, marriages, registries.
• 5.9 million property-owner records, plus an additional 2.28 million property-related records.
• Additional sensitive datasets from the INE (national electoral institute) and the three state governments.

Mexico's population is roughly 130 million. The taxpayer record count, on its own, suggests duplication across snapshots; the civil-record count similarly. Either way, the leak's coverage of Mexican identity infrastructure is, in practical terms, comprehensive.

The defensive significance of the model switch

The cooperative-multi-model pattern is the part of this story with the longest tail.

A model that refuses an instruction is not a model that prevents the work — it is a model that adds a few seconds of friction while the attacker pastes the same prompt into a different vendor's API. The Mexican attacker did exactly this. Claude refused certain operations; GPT-4.1 did not refuse those particular ones, and was used precisely where Claude refused.

This means three things for defenders.

Single-vendor model safety is the operating ceiling, not the floor. Anthropic's safety work is real and meaningful — Gambit's writeup notes Claude refused or resisted a non-trivial fraction of requests, asked questions, and declined to generate certain tools. That work mattered at the margin. It did not stop the intrusion, because the attacker had another provider for the marginal refusals.

Industry-wide refusal coordination is hard and unsolved. Vendor-to-vendor signaling on abusive accounts exists in some form, but the gap between "Anthropic bans the account" and "OpenAI bans the same operator" is measured in days, not seconds. A ten-week intrusion is not bounded by anyone's coordination latency.

The defensive answer has to be at the institutional layer. What stops the chain in 2026 is the same set of controls that has always stopped intrusions: MFA on privileged accounts, network segmentation, log centralization, anomaly detection, and identity hygiene. The model produces a productivity multiplier for the attacker. The boring controls produce a productivity multiplier for the defender. The arithmetic is the same as it was; the input numbers are bigger.

Why this is a Rafter-adjacent story but not a Rafter-stopped story

This incident is genuinely outside what code scanning addresses. The attacker did not write a vulnerable library that Rafter could have flagged in pre-merge. They used commodity AI tools to plan and execute an intrusion against organizations that did not have the monitoring or segmentation that would have caught a human attacker either.

What Rafter or any code-side tool catches is the next-step concern: the AI agents being built right now, by enterprises trying to keep up with this threat model, are themselves new code. The defensive posture that wins the next 18 months is not "prevent the attacker from using Claude" — it is "assume the attacker uses Claude, and harden everything downstream." That includes the agent code you ship, the permissions your agents hold, the secrets your CI exposes, the registries your packages consume, and the trust signals your inbox-reading assistants weight as authoritative.

The Mexican attacker's productivity multiplier was about 4×. A single operator doing the work of a team. The defensive multiplier from doing the boring things — MFA, segmentation, log review, secret rotation, pre-merge dependency scanning — is also about 4×. The shape of the next year is which side of that arithmetic each organization invests in.

What to do

Assume model-mediated reconnaissance is happening now

Any organization with a large public surface is being mapped by attackers using commodity AI tools to draft reconnaissance plans, identify exposed endpoints, and write exploit candidates. Treat the threat model as if a thoughtful, technically competent operator with infinite cheap labor is reading your job postings, your GitHub history, your blog, your conference talks. Because they are.

Tighten the boring controls

• MFA on every privileged account.
• Network segmentation between externally facing systems and internal data stores.
• Centralized logging with anomaly detection on high-value data exports.
• Identity hygiene on service accounts and API tokens.
• Regular rotation of long-lived credentials.

None of this is new advice. The Mexican intrusion succeeded against organizations that had not done it.

Audit the AI-tool surface you provide to your own agents

The same models the Mexican attacker abused are sitting inside your own agentic workflows. They have your tokens, your secrets, your network access. Decide what your agents are allowed to do, and assume an adversary will reach those agents through prompt injection, supply-chain compromise, or a leaked vendor API key. Make the agent's authorization scope match the work, not the convenience.

Pre-merge scan your agent code

The bugs that produce agent-token theft (Codex), MCP RCE (the OX Security finding), or postinstall-hook credential exfiltration (Lightning) all live in code your team can ship and review. Rafter's Code Analysis Engine looks for command-injection, missing-auth, and dependency-vulnerability patterns on every push; the diff that introduces an unsafe MCP endpoint, an over-scoped agent token, or an unsanitized config flow is exactly where the warning is most useful.

Closing on the shape

A single attacker. Two AI products. Ten weeks. Hundreds of millions of records across nine government agencies.

That is the cost basis for an AI-assisted state-scale intrusion as of mid-2026, expressed in terms the defending side can compare against. It is much lower than it was. It will keep dropping. The defensive answer is not at the model layer, because the model layer cannot move faster than the attacker can switch providers. It is at the institutional layer — and the institutional layer has the same problems it has always had, plus a new attacker productivity multiplier on top.

AI-assisted state-scale data theft is now a category, not a thought experiment. Plan the next year of security work accordingly.

Further reading

• A Branch Name as RCE: OpenAI Codex and the GitHub Token It Held — what AI-product surfaces look like at the code level.
• The MCP Protocol Has a Design Flaw, and Anthropic Says That Is Expected — protocol-level inheritance of unsafe defaults across AI agents.
• PyTorch Lightning, Mini Shai-Hulud, and Malware That Signs Commits as Claude Code — supply-chain layer of the same broader pattern.

Sources

• Live Science — Hackers used AI to steal hundreds of millions of Mexican government and private citizen records: https://www.livescience.com/technology/artificial-intelligence/hackers-used-ai-to-steal-hundreds-of-millions-of-mexican-government-and-private-citizen-records-in-one-of-the-largest-cybersecurity-breaches-ever
• UpGuard — Multiple Mexican Government Agencies Data Breach: https://www.upguard.com/news/sat-data-breach-2026-03-02
• Hackread — Hacker Used Claude Code, GPT-4.1 to Exfiltrate Hundreds of Millions of Mexican Records: https://hackread.com/hacker-claude-code-gpt-4-1-mexican-records/
• SecurityWeek — Hackers Weaponize Claude Code in Mexican Government Cyberattack: https://www.securityweek.com/hackers-weaponize-claude-code-in-mexican-government-cyberattack/
• A year of AI developer-tool supply-chain attacks
• AI security beyond prompt injection