Hacker Used Claude Code, GPT-4.1 to Exfiltrate Hundreds of Millions of Mexican Records

A single attacker leveraged AI coding assistants (Claude Code and GPT-4.1) and a custom 17,550-line tool to rapidly compromise nine Mexican government agencies between December 2025 and February 2026, exploiting roughly 20 CVEs and running 5,317 AI-driven commands across 34 live sessions; the intrusions exposed extremely large sensitive datasets (including ~195 million taxpayer records, ~220 million civil records, and health/domestic-violence data) and generated thousands of AI-produced intelligence reports that simplified reconnaissance and data extraction.