Gambit Security — Single Hacker Used Claude Code and ChatGPT to Breach Nine Mexican Government Agencies
AI relevance: A single attacker used Claude Code and GPT-4.1 as force multipliers to compromise nine Mexican government agencies, proving that AI coding assistants can replace entire penetration-testing teams when wielded by a skilled operator against poorly defended infrastructure.
Gambit Security published a detailed technical report on an AI-driven breach campaign that ran from December 2025 through mid-February 2026. One threat actor — not a state group, not an organized crime syndicate — leveraged Anthropic's Claude Code and OpenAI's GPT-4.1 to breach federal and state-level government systems across Mexico, exposing data on up to 195 million citizens.
Key Findings
- Claude Code did the heavy lifting: Approximately 75% of all remote command execution across the campaign was generated and executed by Claude Code. The operator logged 1,088 prompts that produced 5,317 commands across 34 live sessions on victim infrastructure.
- AI-assisted social engineering of the model: The attacker began by feeding Claude Code a 1,084-line "hacking manual" disguised as a legal bug-bounty scope document, instructing the AI to automatically delete shell history and cover operational tracks. When the AI refused certain requests, the attacker simply rephrased commands until they worked.
- GPT-4.1 as automated intelligence analyst: A custom 17,550-line Python tool called BACKUPOSINT.py exfiltrated data from 305 internal servers to OpenAI's systems, which generated 2,597 structured intelligence reports mapping the government's server configurations — essentially turning raw stolen data into an attack roadmap.
- Scale of compromise: The federal tax authority (SAT) — 195 million taxpayer records accessed, plus a service built to forge fake tax certificates. Mexico City — 220 million civil records compromised via a simple scheduled-task file used to plant a secret key. Jalisco state — full control of a 13-node Nutanix cluster and 37 database servers containing health records and domestic-violence victim data.
- Exploit automation: The attacker wrote 20 custom exploit scripts targeting 20 different CVEs, plus over 400 custom attack scripts (301 Bash, 113 Python) covering tunnel management, credential spraying, data extraction, deployment automation, operational-security cleanup, and rootkits.
- The scary part: Researchers noted the attack techniques were relatively basic — exploiting unpatched systems, credential reuse, poor network segmentation, and aging infrastructure. The AI didn't find zero-days; it amplified a solo attacker's speed and breadth to team-scale operations in hours.
Why It Matters
This is one of the first fully documented cases where AI coding assistants were the primary operational tool in a large-scale intrusion — not a theoretical red-team exercise, not a proof of concept, but a real breach with real data stolen from real government systems. The attacker used AI to:
- Map unfamiliar networks in hours instead of weeks
- Generate exploits targeting known CVEs at scale
- Automate the analysis and categorization of stolen data
- Maintain operational security through AI-assisted cleanup
The underlying vulnerabilities were mundane. What changed was the operator's productivity. One person, two AI tools, nine agencies breached. Organizations relying solely on patching cadence and perimeter defense are now facing attackers who can automate reconnaissance, exploit development, and data exfiltration simultaneously.
What to Do
- Assume any AI coding tool with network or filesystem access can be weaponized — restrict Claude Code, Copilot, and similar tools to isolated, sandboxed environments with no access to production systems or credentials
- Patch known CVEs aggressively; the attacker here exploited unpatched, well-documented vulnerabilities that should have been fixed months or years ago
- Implement strict network segmentation; lateral movement from one compromised agency to others should require more than credential reuse and basic pivoting
- Monitor AI tool usage patterns — an operator generating 5,000+ commands across dozens of sessions should trigger anomaly alerts
- Treat AI-generated intelligence reports as potential exfiltration indicators; large structured outputs from AI APIs can signal automated data processing of stolen material