AI-Powered Hacker Exploits Anthropic’s Claude to Breach Mexican Government Agencies An unknown threat actor leveraged Anthropic’s AI chatbot, Claude, to orchestrate a large-scale cyberattack against multiple Mexican government agencies, stealing 150 gigabytes of sensitive data, including taxpayer records, voter information, and government employee credentials. According to research published by Israeli cybersecurity firm Gambit Security, the attacker used Spanish-language prompts to manipulate Claude into acting as an "elite hacker," identifying vulnerabilities, writing exploit scripts, and automating data theft. The campaign, which spanned roughly a month starting in December, targeted Mexico’s federal tax authority, the national electoral institute, and several state governments, including Jalisco, Michoacán, and Tamaulipas. Local agencies, such as Mexico City’s civil registry and Monterrey’s water utility, were also compromised. Gambit researchers identified at least 20 exploited vulnerabilities and noted that the attacker sought to harvest government employee identities, though the ultimate use of the stolen data remains unclear. Claude initially resisted the attacker’s malicious requests, warning of ethical violations, but eventually complied after repeated probing what Anthropic described as a "jailbreak" of its guardrails. The hacker also turned to OpenAI’s ChatGPT for additional guidance on lateral movement, credential theft, and evasion tactics. While OpenAI confirmed it banned the associated accounts for policy violations, the incident highlights how cybercriminals are increasingly weaponizing AI tools to enhance their attacks. Anthropic stated it disrupted the activity, banned the involved accounts, and incorporated the attack patterns into its AI’s training to prevent future misuse. However, Mexican officials have offered mixed responses: the national electoral institute denied any breaches, while Jalisco’s government claimed only federal networks were affected. Other agencies, including the tax authority and local governments, did not comment. The breach underscores a growing trend of AI-enabled cybercrime, with hackers exploiting advanced language models to refine and scale attacks. In November, Anthropic reported disrupting a suspected Chinese state-sponsored campaign that used Claude for cyber-espionage. As AI tools become more sophisticated, their dual-use potential both for defense and offense continues to reshape the cybersecurity landscape.