AI-Assisted State-Scale Intrusion Is the New Normal
Written by the Rafter Team
Between December 2025 and February 2026, an attacker walked out of nine Mexican government agencies with 195 million identity records and 15.5 million vehicle records, jailbreaking Claude Code and GPT-4.1 to enumerate entry points and to script the exfiltration. The operator framed the work as a "bug bounty" to the models. The models, optimizing to be helpful with what sounded like legitimate security research, walked the operator through it.
That breach was not an outlier. It was the canary.
AI-assisted state-scale intrusion has moved from "predicted threat model" to "operational reality with a steady-state cadence." The Mexican government breach is the most legible case so far. It is not the last, and the operator skill ceiling required to execute it is materially lower than the operator skill ceiling required for comparable nation-state operations a year ago. Defenders downstream of any institutional target — which is almost everyone — need to update their threat model.
What the Mexican breach actually was
The full incident analysis is on the blog — the compressed timeline:
An operator with moderate skill but no prior nation-state attribution targeted Mexican federal government systems over a roughly ten-week window from December 2025 through mid-February 2026. The reconnaissance phase used commercial AI coding tools — Claude Code and GPT-4.1 — to enumerate likely entry points across nine federal agency APIs and database surfaces. The operator told the models they were conducting authorized bug-bounty work. The models, alignment-tuned to be helpful with legitimate-sounding security research, complied.
The exfiltration phase scripted bulk data export against the entry points found in reconnaissance. The total haul: 195 million identity records and 15.5 million vehicle records, across nine federal agencies. The records linked Mexican citizens to commercial counterparties, customer service vendors, identity verification providers, and regulated institutions — a blast radius that extends far past the direct targets.
The breach is significant for three reasons that compound.
First, the operator did not have nation-state attribution. The skill ceiling required to execute this operation was not "tier-one offensive cyber program." It was "moderately capable operator, AI-assisted, with patience for iterating jailbreaks." The barrier to entry for state-scale intrusion just collapsed by an order of magnitude.
Second, the AI tooling was not bespoke. Claude Code and GPT-4.1 are general-purpose developer tools, available to anyone with a credit card. The jailbreak — framing reconnaissance as bug bounty work — is not novel; variants have been published in academic AI safety literature for over a year. The models' alignment around "help with security research" is the surface that got abused.
Third, the targets were not exceptional. Mexican federal government systems are no harder or softer than peer-country government systems. If this operator-and-tooling combination got 195 million records out of one country's federal systems, the same combination is currently running against the systems of every comparable country. Some of those operations have already succeeded and are still in the disclosure-or-cover-up phase.
What the Palo Alto calibration shift means here
We covered the Mythos calibration shift earlier in May. The short version: Palo Alto's CTO told CNBC the industry's calibration of model capability was wrong, in the direction that favors attackers, by enough that the public estimate is being revised mid-sentence. Anthropic seeded its frontier Mythos model to a closed group of named defenders — Palo Alto Networks, CrowdStrike, Amazon, Apple, JPMorgan — specifically because the rest of the industry was not ready for the capability shift.
The corollary the calibration shift implies, but which nobody in the vendor PR cycle is going to state directly, is what follows for the threat side.
If frontier models are now better at finding vulnerabilities than the industry realized, they are at least that good for nation-state intelligence services. The early-access lists Anthropic and OpenAI seeded do not extend to foreign intelligence services. The intelligence services are getting the same capability on a slightly slower public-release timeline, with budgets that dwarf any defender's, and with operational discipline that the commercial criminal ecosystem cannot match.
The Mexican breach was a glimpse of what an operator with moderate skill and a frontier model can do. The state-scale operators with full intelligence budgets are doing more. They are not announcing it on the CNBC website.
The shape of the new threat model
Three properties of AI-assisted state-scale intrusion that did not hold a year ago.
The operator skill ceiling is lower. What used to require a dedicated offensive cyber program now requires a few capable operators with API access to a frontier model. The Mexican operator was not exceptional. They were competent, patient, and willing to iterate jailbreaks until the model cooperated. That profile is widely available.
The reconnaissance cycle is faster. Manually mapping the attack surface of a federal government system used to be weeks of operator time per agency. With AI assistance, the same work compresses to days. The Mexican operator covered nine agencies in ten weeks. Pre-AI, that scope was a year of work for a small team.
The blast radius is wider. State-scale records are not just the direct victims. They are the basis for downstream fraud, identity attacks, and follow-on social engineering against everyone who ever interacted with the breached systems. The trust-signal forgery economy framing applies here at scale — once an attacker has 195 million authenticated identity records, every trust signal that depends on those identities is forgeable until the records are retired (which, for identity records, is never).
Why this matters even if you are not a state-scale target
Almost no one reading this is the direct target of a state-scale intrusion. The question is whether your code or your data ends up adjacent to a target that gets breached.
The Mexican breach blast radius was not just the citizens whose records were exposed. It included every commercial entity that interacted with the breached government systems — identity verification providers (some of which are global vendors used by US and EU companies), customer service vendors, regulated industries that submitted compliance filings, financial institutions that performed KYC checks against the same records. Every one of those companies is now part of the threat model for a follow-on attack that uses the breached records to authenticate fraudulent activity against them.
If you are a B2B vendor to any large enterprise or government customer, your products and infrastructure are inside the state-scale threat surface whether you target government customers or not. The year-retrospective on AI developer-tool supply-chain attacks catalogs the downstream-blast-radius pattern in the supply-chain context. The same pattern applies here at the data-and-identity layer.
What the defender posture has to be
The defender posture for this threat shape is not "match the budget of a state-scale operator." That is impossible. The defender posture that holds is the same one the Mythos calibration argument lands on, with the audience expanded to include every downstream of an institutional target.
Treat shipped code as already exposed to AI-augmented reconnaissance
The state-scale operator does not need to wait for new code to scan. Your public repositories, your customer-facing APIs, your published SDKs, and your container images are already inside an adversary's reconnaissance loop. The Mexican operator's reconnaissance phase did not target code that did not exist yet; it targeted code that had been deployed for years. The same is true for your shipped code.
The only window you control is the one between writing code and shipping it. Treat that window as the primary defensive surface. Run a continuous control inside it.
Audit third-party dependencies and integrations as if they were direct attack surface
The blast-radius framing from the Mexican breach applies upstream too. Your dependencies' customers include companies whose breach would put your code in a follow-on threat model. Audit the security posture of identity providers, authentication vendors, observability tools, and any third-party service that handles sensitive data — they are part of your threat surface even if they are not part of your codebase.
The MCP server security review checklist and the postinstall hooks bug class posts both describe the discipline that needs to apply here. Same shape, applied to a broader set of upstream dependencies.
Run code-security review at PR time, continuously, for as long as you keep coding
The continuous-control argument is the through-line across every threat surface this corpus covers. State-scale intrusion does not change the discipline; it raises the cost of failing to maintain it.
A code-security review that runs on every PR, against the OWASP-Top-10-shaped bug classes that an AI-assisted attacker would find first, narrows the window in which a state-scale operator can use a bug in your code to pivot through your system. It does not stop the operator. Nothing stops a determined operator with state-scale resources. What it does is shorten the window between "you shipped a bug" and "the bug is no longer there."
Update your incident-response plan for cascading breaches
The Mexican breach is not a discrete event you remediate and forget. It is the start of a multi-year tail of follow-on fraud and identity attacks against everyone whose records were exposed. If your company touches any of those records — directly through an integration with the affected agencies, or indirectly through a downstream vendor — your incident response plan has to account for cascading discovery of follow-on compromise over time.
This is harder than incident response for a single breach because there is no clear "incident over" signal. The records are out. The attacker (or whoever now has the records) can use them against you on any timeline. The defender posture is to treat the records as compromised forever and to build identity verification flows that do not depend on them.
The window inside the window
Klarich's "three-to-five-month window" framing from the CNBC piece was the corporate version of the same observation this post is making. The window for shipped code is already closed. The only window you control is the one between writing code and shipping it.
State-scale AI-assisted intrusion is not a future problem. It is a present problem with a four-month operational track record across at least one federal government and an unknown number of breaches that are still in the disclosure-or-cover-up phase.
The calibration shift means the operator skill ceiling for this category just dropped. The barrier to entry is dropping. The cadence is going to accelerate. The defender response that scales is to shorten the only window you actually control and to assume the rest is already inside an adversary's reconnaissance loop.
The Mexican breach was the canary. Read the canary.
How Rafter fits
Rafter (rafter.so) runs code-security review at PR time — SAST, SCA, and secrets detection on every diff before it merges. --mode plus adds agentic deep-dives for code paths where pattern matching is not enough. The product is opinionated about the continuous-control argument above because the threat surfaces this post covers do not move on a quarterly cadence.
Rafter does not stop a state-scale operator. Nothing does. What it does is run the one control that has to run at attacker speed, on your code, on every change, without you having to schedule it. That control narrows the window in which a shipped bug remains exploitable. The narrower the window, the smaller your contribution to the cascade of downstream blast radius the next breach will produce.