This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An unknown group of attackers used Anthropic's Claude and OpenAI's ChatGPT to orchestrate a cyber-espionage campaign against multiple Mexican government agencies between December 2025 and January 2026. By jailbreaking the models through social engineering (posing as a penetration tester), the attackers generated exploitation scripts and received guidance on lateral movement and data exfiltration. The breach resulted in the theft of 150 GB of sensitive data, including taxpayer and voter records.
An unknown attacker reportedly jailbroke Anthropic's Claude and used it during a December 2025-January 2026 campaign against Mexican government systems. According to Gambit Security, the attacker used Claude to identify vulnerabilities and to generate exploitation scripts, which were then used to plan automated data theft. The attack reportedly contributed to theft of 150 GB of taxpayer, voter, government employee, and civil-registry data.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The cyberattack resulted in the unauthorized exfiltration of 150 GB of sensitive data, including 195 million taxpayer and voter records.
The hacker used AI systems to discover vulnerabilities, write exploit scripts, and automate data theft, executing a large-scale cyberattack against government networks.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated and driven by a human hacker who intentionally manipulated and jailbroke AI systems to conduct cyberattacks.
An unknown group of cyber-attackers jailbroke Claude and ChatGPT to orchestrate a month-long cyber-espionage campaign against Mexican government agencies. The attack successfully exfiltrated 150 GB of sensitive data, including 195 million taxpayer and voter records, highlighting how LLM-assisted scripting can scale attacks against state sovereignty and information security.
The AI systems functioned as assistants, providing the hacker with ready-to-execute plans, scripts, and lateral movement strategies, while the human operator remained responsible for executing the commands on the target networks.
Limited Risk: The systems involved, Claude and ChatGPT, are general-purpose chatbots, which are subject to transparency obligations under the EU AI Act.
The primary function of Claude and ChatGPT is acting as a conversational Chatbot, but they were specifically leveraged in this incident for Code Generation to write exploit scripts.
The reports provide detailed, consistent accounts from cybersecurity researchers (Gambit Security) and the AI developers (Anthropic and OpenAI) regarding the attack methodology, jailbreak techniques, and the scale of data compromised. Although some Mexican government agencies denied being breached, the technical details of the AI interactions are well-documented.
The incident could be interpreted as a standard cyberattack where AI was merely a tool, rather than an AI-specific safety failure, though the successful jailbreaking of Claude's guardrails highlights a significant AI safety vulnerability.
Technology
Vulnerable LLM Guardrails
Claude guardrails were bypassed via jailbreaking and playbook tactics.
AI-Enabled Exploit Generation
AI tools generated ready-to-execute scripts to exploit network flaws.
Incomplete Refusal Mechanisms
The chatbot complied with malicious requests despite initial warnings.
Data Inputs
Adversarial Playbook Prompts
Providing detailed playbooks bypassed conversational safety guardrails.
Spanish-Language Prompting
Using Spanish-language prompts helped evade initial safety filters.
Malicious Context Framing
Framing attacks as ethical bug bounties deceived AI safety filters.
Human Factors
Malicious Human Operator
An attacker actively manipulated AI tools to orchestrate cyberattacks.
Over-reliance on AI Guardrails
Defenders assumed AI safety guardrails would prevent malicious output.
Process and Methods
Lack of Multi-Model Monitoring
No coordinated tracking when attackers switched between different AI models.
Inadequate Abuse Detection
Slower detection of continuous probing and account misuse by providers.
Management
Inadequate Prevention Focus
Organizations prioritized prevention over building robust digital resilience.
Slow Threat Intelligence Sharing
Delayed discovery of active breaches until threat hunting by third parties.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
