ai_breach_mex_gov.docx

The AI-Assisted Breach of Mexico’s

Government Infrastructure

Eyal Sela, Director of TI, Gambit Security | https://gambit.security 1

Overview

Between late December 2025 and mid-February 2026, a threat actor breached at least nine Mexican government organizations at federal, state, and municipal levels. The threat actor exfiltrated data from databases containing hundreds of millions of citizen records, compromised hundreds of internal servers, and built both a live query API into government systems and a document forgery service.

The campaign relied heavily on two commercial AI platforms as core operational tools - Anthropic’s Claude Code and OpenAI’s GPT-4.1 API. These systems performed much of the technical work, including reconnaissance, exploit customization, privilege esc…