Hacker Uses Claude and ChatGPT to Breach Multiple Government Agencies

A single threat actor conducted a sophisticated campaign (Dec 2025–Feb 2026) against nine Mexican government agencies, stealing hundreds of millions of citizen records. The attacker heavily automated the intrusion using Anthropic Claude Code and OpenAI GPT-4.1 — Claude Code executed ~75% of remote commands across 34 sessions while a custom GPT-4.1-enabled pipeline processed harvested data from ~305 servers into 2,597 structured reports — and developed 20 tailored exploits against 20 CVEs. Despite AI-driven speed and scale, the breaches leveraged conventional security gaps, underscoring the need for basic controls (patching, credential rotation, segmentation, EDR).