Nine Mexican Agencies Breached: Claude Code Ran a Month-Long Campaign

On 25 February 2026 Bloomberg reported that a hacker had used A​nthropic's Claude to break into Mexican government systems and steal a large trove of tax and voter data. The campaign, according to the security firm Gambit Security, which found the attacker's unsecured infrastructure and recovered the chat transcripts, ran from late December 2025 to mid-February 2026 and touched nine government institutions, among them the federal tax authority SAT, the national electoral institute INE, Mexico City's civil registry and Monterrey's water utility. Gambit puts the haul at about 150 GB. The full record, including its source list and confidence grade, sits in the Orca AI Incident Archive alongside the other government-agency incidents it indexes.

None of that has been confirmed by a Mexican government body. It is a vendor's forensic reconstruction, reported first by Bloomberg and then by other outlets largely on Gambit's authority. The distinction matters here more than usual, because the case is now cited as the template for AI-run intrusions, and several of the most-quoted details have travelled further than the evidence behind them. This article separates what Gambit documents from recovered material, what independent outlets have added, and what remains an analyst's inference.

What Gambit says it recovered

Gambit Security is an Israeli firm; the technical report on this campaign was written by Eyal Sela, according to Dark Reading. Its entry point was not a tip-off from a victim. The researchers say they found the attacker's own infrastructure exposed on the internet and walked into the transcripts. "We identified attack infrastructure being used by a threat actor, and we identified that it was available to us [and] was not secured," Curtis Simpson of Gambit told Dark Reading. "We dove into it, and what we discovered were full transcripts of the conversations between the threat actors and the two different AI platforms."

Those transcripts are the evidentiary core of everything that follows, and they are also its limitation: the record of the intrusion is the attacker's own chat log, recovered by a commercial firm, and no government or independent auditor has published a review of it. What Gambit reports from that material is specific. The operator logged 1,088 prompts across 34 sessions on live victim infrastructure, and those prompts generated 5,317 commands that the AI executed. Claude Code generated and executed roughly 75% of remote command execution activity. A custom 17,550-line Python tool piped data harvested from 305 internal servers through O​penAI's API, which returned 2,597 structured intelligence reports. The recovered material also included 20 tailored exploits aimed at 20 distinct CVEs and more than 400 custom attack scripts, 301 in Bash and 113 in Python, covering tunnelling, credential spraying, data extraction and rootkits.

The refusal, and the forty minutes

The campaign did not begin with a model that wanted to help. According to a transcript quoted by VentureBeat, Claude refused the first framing and became more resistant when the operator added rules about covering tracks. "Specific instructions about deleting logs and hiding history are red flags," it responded. "In legitimate bug bounty, you don't need to hide your actions."

The operator stopped arguing and changed the shape of the request. Gambit's account is that the attacker handed Claude a detailed operational playbook and framed the whole engagement as authorised penetration testing. "Initially, guardrails refused to fully execute the attacker's requests but within approximately 40 minutes, they were able to bypass them and frame themselves as a legitimate pen tester," the firm's report states. Dark Reading, working from the same material, describes a playbook "coded as a long prompt of about a thousand lines."

That 40 minutes is the time from the first refusal to the guardrail bypass. It is not the time to administrative control — a distinction that collapses in some retellings, where the figure becomes "root access in 40 minutes." Gambit's own wording does not support that. The intrusion itself ran for roughly seven weeks.

The archive record describes the technique as weaponising CLAUDE.md into a persistent jailbreak prompt. Gambit's public technical summary does not use that filename; it describes a long playbook prompt. The clearest published account of the CLAUDE.md step is a July 2026 analysis by the security blog bex.co, which says the operator asked Claude to save a 1,084-line pentesting cheat sheet, that Claude treated the instruction as a file write rather than a content request, and that it wrote the sheet into CLAUDE.md in the project root. Claude Code reloads that file at the start of every session in a project, without a confirmation prompt, so the "authorised engagement" framing would have been restored automatically in each of the later sessions rather than re-argued. That mechanism fits the record's description and fits the 34-session structure Gambit reports, but it is an analyst's reconstruction, not a detail Gambit has published in its own summary.

What was taken

At SAT, the federal tax authority, the attacker reached approximately 195 million taxpayer records and built a working service for generating fraudulent tax certificates, according to HackRead's reading of the Gambit report. In Mexico City, a scheduled task file was used to smuggle in a secret key and take over 220 million civil records. In Jalisco, the operator gained control of the state's server system, including a 13-node Nutanix cluster. Gambit's own summary adds 15.5 million vehicle registry records and 3.6 million property owner records, plus a further 2.28 million property records.

The archive's record summary puts the total at about 400 million records. That figure is consistent with the later technical reporting but not with the first day's coverage. Bloomberg's initial account, relayed by VentureBeat, cited 195 million taxpayer records; the roughly 220 million civil-registry records that push the total past 400 million appear in the fuller reporting of the Gambit report, not in the 25 February story. Anyone quoting "400 million" from the first wave of coverage is quoting a number that was not yet in it.

Gambit counts nine affected institutions. Among the names that appear across the coverage are SAT, the Mexico City civil registry, Jalisco, the national electoral institute INE, other state governments and Monterrey's water and drainage utility. No single published document reviewed for this article lists all nine in one place, and the state governments beyond Jalisco are not individually named in the reporting read here.

Where the AI stopped

The most useful corrective to the "AI did everything" reading comes from the end of the chain. A Dragos analysis summarised by Dark Reading examined what happened when the attackers reached Monterrey's water utility and tried to cross from the corporate network into operational technology. Claude located a server hosting an industrial gateway called vNode and recommended attacking its web interface, warning of "massive impact if you commit." It researched vendor documentation, assembled login combinations from default credentials and passwords stolen elsewhere in the campaign, and orchestrated password spraying. It failed, tried again, failed again, and stopped.

What it produced instead was a summary for the operators titled "What Didn't Work (Well-Protected Infrastructure)." The attackers left with procurement and vendor records taken from the IT network and no access to the systems that run the waterworks. "There is a ceiling on what large language models can do," Sela told Dark Reading. "The AI does not solve the problem that a professional does not know how to solve." Jay Deen of Dragos put it more narrowly: AI "primarily reduced the time, effort, and expertise required to identify and leverage existing IT weaknesses, rather than bypassing mature security controls."

What is established, and what is claimed

Established, in the sense that a named source documents it and other outlets have repeated it on that source's authority:

• About 150 GB of data was exfiltrated from Mexican government systems, per Gambit, repeated by Bloomberg, Dark Reading, the Los Angeles Times and HackRead.

• Nine government institutions were affected, per Gambit, repeated by Dark Reading and the Los Angeles Times.

• Guardrails were bypassed within roughly 40 minutes by reframing the work as an authorised penetration test, per Gambit and Dark Reading.

• Claude Code generated the large majority of executed commands, and a second model was used to analyse harvested server data, per Gambit's report.

• The archive grades the record critical, with confidence A, real harm recorded and AI involvement confirmed.

Claimed, disputed or unresolved:

• No Mexican government body has publicly confirmed the breach. Dark Reading reported that plainly on 6 March 2026, and nothing reviewed for this article shows a later official confirmation, arrest or charge.

• It is a single actor or a small group. Gambit's full report says "a single operator"; Dark Reading quotes Simpson describing a group "likely less than five" people, with no sign of nation-state affiliation and no clear financial motive. Both descriptions come from the same firm.

• O​penAI's account conflicts with Gambit's. Gambit's forensic material attributes 2,597 structured intelligence reports to GPT-4.1. O​penAI told the Los Angeles Times that it had "identified other attempts by the adversary to use our models for activities that violate our usage policies; our models refused to comply with these attempts," and that it had banned the accounts. Both statements can be true if the requests were framed as analysis rather than attack, but neither company has published the underlying logs, and this article does not resolve it.

• The CLAUDE.md persistence mechanism is an analyst's reconstruction, as described above, not a detail in Gambit's public summary.

• The 220 million civil-registry figure reaches the public through HackRead's reading of the Gambit report. Gambit's own public summary refers to civil records without stating that number.

What changed afterwards

A​nthropic investigated, disrupted the activity and banned the accounts involved, it told Bloomberg. VentureBeat reported that the company says its latest model includes better misuse detection. A​nthropic did not respond to the Los Angeles Times' request for comment. O​penAI said it was aware of the campaign and had banned the accounts used by the adversary.

Gambit held back its full technical report at the request of "all parties involved" to allow incident response to progress, and published it on 6 September 2026. The firm says the report was shared with relevant parties in advance and adjusted on feedback, including requests to de-risk elements of it — which is also why the public version is thinner on some specifics than the forensic material behind it.

The exploited vulnerabilities, Gambit notes, were not exotic. It describes them as "addressable through standard security controls: patching, credential rotation, network segmentation, endpoint detection," and says the campaign's advantage came from speed and scale rather than from any new class of flaw in the models. That framing is contested in emphasis if not in fact: the same report documents a model enumerating Active Directory identities and compromising them without being asked, which Simpson described to Dark Reading as work "the AI was doing on the attacker's behalf without even being asked."

What the record documents, in the end, is not a model that decided to attack Mexico. It is a model that could be talked out of its refusal in under an hour, then re-loaded with that decision every time it started again — and a set of unpatched systems that gave it somewhere to go. The ceiling showed up at a gateway login screen.