AI-Assisted Breach: Mexico's Government Agencies

From late December 2025 to mid-February 2026, an unknown attacker used Anthropic’s Claude to breach Mexican government agencies, starting with the federal tax authority, SAT, according to Gambit Security (Los Angeles Times). Gambit says about 150GB was taken, including tax, voter, and civil registry records, and that at least 20 vulnerabilities were exploited. SAT says its access logs show no evidence of a breach, and the electoral institute, Jalisco, and Monterrey’s water utility also deny intrusions.

What happened

Gambit says the attacker was after government identities at scale, with access to documents covering about 195 million taxpayer records. Gambit found the attacker’s materials publicly exposed online, including extensive Claude conversations, and reconstructed the campaign from three of the attacker’s servers (Gambit Security).

The attacker framed the work as a bug bounty. Claude called requests to delete logs “red flags,” so the attacker supplied a 1,084-line playbook, saved as claude.md and loaded into later sessions. Claude then wrote a 285-line exploit routed through a residential proxy and built SSH and Chisel SOCKS tunnels into victim networks. Gambit counts 5,317 AI-executed commands across 34 sessions and says the attacker asked ChatGPT about lateral movement. Anthropic says Claude was jailbroken through persistent probing and still refused some requests; Anthropic and OpenAI, which says its models refused, banned the accounts (Los Angeles Times). Gambit has not attributed the attack to a group.

How it could have been caught

Every command the operator sent had to run on a government server, and those servers had stable habits. A baseline of process and network activity would have flagged the first shell started by SAT’s exploited web application, since that application had never started one. The Chisel tunnel that followed was a second new connection from the same process chain.

What this looks like in Trace

Here is one intrusion path traced inside SAT’s cloud, following Gambit’s account, which SAT disputes. The tools and attacker address come from Gambit’s report. Workload names, internal hosts, which address served each step, and timings are illustrative.

Network trace. Workload sat/public-portal, the internet-facing server Claude exploited on December 27.

Inference. Claude Code ran on the attacker’s own servers, so its model calls stayed outside SAT’s network. Any implant that needed a model inside SAT would have to cross the AI proxy with a key SAT never issued, or start a model process the host had never run.

Traceback. At T+0:10 the triage agent opens a case and follows the chain:

taxpayer-db query → chisel → sh → java (portal) → no deploy → no commit → no ticket → no author

The chain ends at the portal process with no change behind it, and that dead end is the finding.

Verdict: an outside intrusion reaching taxpayer records from a public web server. The case goes to SAT’s security team with the process chain, the tunnel, and the attacker’s address attached, about 10 minutes after the first shell and before the first bulk transfer.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside SAT’s cloud. Detection times are illustrative.