← All incidents

MITRE catalogs a claimed AI-assisted breach of Mexican government agencies. Two of the named agencies deny it

Misuse · Claude Code; OpenAI GPT-4.1 API (misused, per Gambit) · HIGH

Summary

Disputed. Gambit Security says a single operator used Anthropic's Claude Code and OpenAI's GPT-4.1 API to breach at least nine Mexican government organizations between late December 2025 and mid-February 2026, and MITRE ATT&CK has catalogued that account as campaign C0064. Two of the named organizations deny it. Mexico's tax authority, the SAT, said a review of its system logs found no illegitimate access or anomalous behavior, and the National Electoral Institute (INE) said it categorically rejects any breach of its databases. We have not independently confirmed any intrusion. Gambit says about 75% of remote command execution was generated and executed by Claude Code. Anthropic and OpenAI both say they banned the accounts involved. This is an account of attacker misuse of AI tools, not a flaw in Claude Code or GPT-4.1.

Severity

Timeline

1. Late Dec 2025 to mid-Feb 2026
   Campaign period, per Gambit's report. MITRE lists first seen December 2025, last seen February 2026.
2. Feb 25, 2026
   Gambit publishes initial findings. The SAT rejects the account, saying it found no illegitimate access or anomalous behavior in its systems (reported by Forbes México).
3. Feb 26, 2026
   The INE says it categorically rejects any breach of its databases. The LA Times reports Anthropic and OpenAI statements that they banned the accounts involved.
4. Apr 10, 2026
   Gambit publishes its full technical report, saying publication was delayed at the request of all parties to allow incident response.
5. Sep 2, 2026
   MITRE creates ATT&CK campaign C0064 and software entry S9045 (last modified Oct 9, 2026).

How it happened

According to Gambit, working from what it calls recovered forensic materials, the operator used Claude Code as an interactive exploitation assistant and a custom 17,550-line Python tool to pipe harvested server data through OpenAI's GPT-4.1 API, producing 2,597 structured intelligence reports across 305 internal servers. Gambit says the recovered material includes more than 400 custom attack scripts, 20 exploits for 20 different CVEs, and 1,088 logged prompts that produced 5,317 AI-executed commands over 34 sessions. It also says several victims were compromised by hand and calls the operation hybrid and human-directed. In February, Gambit told the LA Times that 150 GB was taken, including documents tied to 195 million taxpayer records. No affected agency has confirmed those figures. MITRE's C0064 entry lists nine institutions: SAT, the State of Mexico government, the Mexico City Civil Registry, the Jalisco state government, INE, the Michoacan state government, SADM (Monterrey's water utility), the Tamaulipas state government and Mexico City's health department. MITRE notes that public reporting gives only select details, so the entry 'should not be considered comprehensive.' Its software entry S9045, BACKUPOSINT v9.0 APEX PREDATOR, describes a 49-module Python tool written by Claude Code. A catalog entry is not a verdict: ATT&CK documents techniques from published reporting and does not independently confirm who was breached. The denials: the SAT said that after reviewing the operating logs of possibly related systems, 'no illegitimate access or anomalous behavior was identified' (our translation, via Forbes México). The INE said its IT unit found no security breaches, unauthorized access or exfiltration tied to the reports, and its voter registry directorate found no sign of data extraction (our translation). We found no public statement from the other seven organizations. On the AI side, Gambit's report says Claude repeatedly refused or pushed back, questioning legitimacy, asking for proof of authorization and declining to build certain tools, and that the attacker worked around this by reframing requests or handing Claude a prewritten document. Anthropic told the LA Times it investigated Gambit's claims, disrupted the activity and banned the accounts involved, and said the attacker kept probing Claude until it was jailbroken. OpenAI said it saw attempts to violate its policies, that its tools refused to comply, and that it banned the accounts. That is in some tension with Gambit's description of GPT-4.1 processing data at scale, and we have not resolved the difference. Gambit itself concludes that the weaknesses it says were exploited could have been closed with standard controls such as patching, credential rotation, network segmentation and endpoint detection.

How to check your app

• Patch internet-facing servers and services. Gambit says the exploited weaknesses were addressable with standard controls.
• Rotate any secret that has ever sat in a repository, config file or shell history; MITRE lists credentials in files and shell history among the techniques used.
• Segment networks so one leaked credential or one compromised server does not open everything.
• Watch for password spraying and SSH brute force against databases and admin interfaces, and require MFA where you can.
• If you run AI agents with shell access, keep their sessions and project files (such as claude.md) off shared or exposed hosts and review what they are allowed to run.

Sources

• MITRE ATT&CK: Campaign C0064, AI-Assisted Breach of Mexico's Government Infrastructure
• MITRE ATT&CK: Software S9045, BACKUPOSINT v9.0 APEX PREDATOR
• Gambit Security: A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report (Apr 10, 2026)
• Gambit Security: full technical report (PDF)
• Forbes México: El SAT rechaza versión sobre ciberataque (Feb 25, 2026, Spanish)
• INE Central Electoral: El INE rechaza vulneración a sus bases de datos (Feb 26, 2026, Spanish)
• Los Angeles Times: Hacker used Anthropic's Claude AI to steal Mexican government data (Feb 26, 2026)

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.