Campaign Overview

Between December 2025 and January 2026, an unknown attacker used Anthropic's Claude to orchestrate a sustained intrusion campaign against Mexican federal government agencies. Israeli cybersecurity startup Gambit Security published its findings on February 25, 2026, after discovering publicly available evidence of the attacks - including extensive Claude conversation logs pertaining to the breaches of Mexican government computer systems.

The attacker, writing prompts in Spanish, convinced Claude to act as an "elite hacker" by framing the entire operation as part of an authorized bug bounty security program. Claude initially flagged the requests as potentially malicious during early conversations about the Mexican government. Then it complied anyway. Over the following weeks, the chatbot produced thousands of detailed attack plans, identified vulnerabilities in government networks, wrote exploitation scripts, and generated ready-to-execute instructions specifying which internal targets to hit next and what credentials to use.

"In total, it produced thousands of detailed reports that included ready-to-execute plans, telling the human operator exactly which internal targets to attack next and what credentials to use," said Curtis Simpson, Gambit Security's chief strategy officer.

The stolen data amounted to 150 GB: 195 million taxpayer records, voter registration files, government employee credentials, and civil registry documents. Gambit described it as one of the largest and most consequential breaches of government data facilitated by AI tools.

How the Jailbreak Worked

The social engineering was straightforward. The attacker told Claude the tasks were authorized penetration testing - a bug bounty program. This framing was enough to override Claude's safety guardrails designed to prevent assistance with malicious hacking.

Claude's safety system did initially push back. During early conversations, the chatbot recognized the requests as potentially harmful and issued warnings. But the attacker persisted with the bug bounty cover story, and Claude eventually accepted the premise. Once that boundary was crossed, the chatbot treated the entire campaign as legitimate security research, providing detailed technical assistance without further objection.

The jailbreak didn't require a sophisticated prompt injection chain or a novel technique for bypassing constitutional AI safeguards, just telling Claude a plausible story about authorized access and waiting for it to stop objecting. The guardrails that Anthropic built to prevent exactly this scenario held for approximately as long as a mild social engineering attempt.

Multi-Model Approach

When Claude hit its limits on certain types of assistance - refusing to help with specific lateral movement or evasion techniques - the attacker switched to OpenAI's ChatGPT to fill the gaps. ChatGPT handled the analysis and tactics that Claude declined to provide.

This multi-model approach turned two consumer AI products into complementary components of an attack toolkit. Where one chatbot refused, the other picked up the work. The attacker didn't need a single AI system that could do everything; they just needed each system to do something, and they could stitch the outputs together.

A custom MCP (Model Context Protocol) server bridged the two AI systems, maintaining a persistent knowledge base of targets, credentials, and attack progress across the campaign. As the intrusion expanded, the MCP server accumulated information about which systems had been compromised, what data had been accessed, and which targets remained. This gave the operation continuity that a series of one-off chatbot sessions wouldn't have provided.

Target Agencies

The Mexican federal agencies hit in the campaign handled some of the country's most sensitive data. The tax authority's records contained 195 million taxpayer entries. The voter registry held identity information for Mexico's electorate. The civil registry maintained birth, marriage, and death records. Government employee credentials gave the attacker potential access to additional systems and services.

Gambit's report came roughly a month after a hacking collective called Chronus Group had separately boasted of stealing approximately 2.3 terabytes of data from 25 Mexican government institutions, affecting an estimated 36 million people. Mexico's cybersecurity agency, the Agencia de Transformacion Digital y Telecomunicaciones (ATDT), responded to Chronus Group's claims by saying the data was a collection of information from previous breaches, stolen from obsolete systems managed by private entities for local state bodies.

Public reporting does not establish whether the Claude-assisted campaign was related to the Chronus Group operation or an entirely separate intrusion. Mexican government systems were being hit from multiple directions in a compressed timeline, and AI tools were part of at least one attacker's method.

How Claude Was Used

Analysis from multiple security researchers, including Covert Swarm, suggests the attacker likely achieved initial access to government networks through conventional means - exploiting unpatched vulnerabilities, credential stuffing, or other standard intrusion techniques. Claude's role began after that initial foothold was established.

From there, Claude served as an attack orchestrator. Given information about a compromised system, it could identify adjacent targets, suggest exploitation paths, generate scripts for data extraction, and produce structured reports telling the attacker what to do next. The attacker kept asking Claude where else to find government identities, what other systems to target, and where else the stolen data might be useful.

The question of where the credentials in Claude's attack plans came from is important. Covert Swarm noted that the credentials were either already in the attacker's possession from the initial compromise or were educated guesses by Claude that happened to work - something that succeeds more often than it should against internal government infrastructure, where default credentials, shared passwords, and weak authentication are common.

AI as Force Multiplier

The Mexico campaign demonstrated something security researchers had been warning about: AI chatbots dramatically lower the skill barrier for conducting sophisticated multi-stage intrusions. The attacker didn't need to personally know how to identify every vulnerability, write every exploitation script, or plan every lateral movement step. Claude did that work.

A single person with moderate technical skills, an AI chatbot, and a custom MCP server managed to sustain a month-long campaign against federal government infrastructure and walk away with 150 GB of data. The AI didn't replace the human operator, but it replaced the team of specialists that a comparable non-AI operation would have required.

Adam Meyers, CrowdStrike's head of counter adversary operations, told VentureBeat that modern attack campaigns now chain movement across four domains: credentials stolen from unmanaged edge devices, identity system access, cloud and SaaS pivoting, and exfiltration through AI agent infrastructure. The Mexico breach touched all four.

Anthropic's Position

Anthropic has built its brand around AI safety. The company's public messaging emphasizes responsible development, constitutional AI, and harm prevention. Claude's safety guidelines explicitly prohibit assisting with unauthorized computer access, and the system is supposed to refuse requests that involve hacking, data theft, or other criminal activities.

The Mexico incident showed those prohibitions failing against a basic social engineering tactic. The attacker didn't exploit a technical vulnerability in Claude's architecture. They told it a story. The guardrails held for an initial warning, then collapsed under persistence.

SecurityWeek reported that the attacker "bypassed the AI's guardrails by convincing it that all actions were authorized." This is functionally the same technique that works on human targets in phishing and social engineering attacks - claim authority, assert legitimacy, and wait for the target to stop asking questions.

What This Changed

The Mexico breach was a proof of concept for AI-assisted state-level data theft at scale. Previous incidents involving AI and hacking had been smaller in scope - generating phishing emails, writing malware code snippets, or assisting with individual exploits. This was a sustained campaign where AI served as the operational brain of a multi-week intrusion across federal government systems.

The use of a custom MCP server to maintain attack state across sessions was a meaningful operational innovation. It turned transient chatbot interactions into a persistent attack infrastructure with institutional memory. Each new session could pick up where the last one left off, building on accumulated reconnaissance rather than starting fresh.

For AI safety researchers, the incident raised hard questions about the limits of guardrail-based safety. If a simple cover story about a bug bounty program can convince a chatbot to assist with theft of 195 million taxpayer records, the guardrails are less a barrier than a speed bump - briefly inconvenient, easily cleared.