The AI-Assisted Breach of Mexico's Government Infrastructure

Gambit Security published a technical deep-dive into a breach of nine Mexican government organizations between December 2025 and February 2026, in which a single threat actor leaned on Claude Code and OpenAI’s GPT-4.1 API to handle most of the heavy lifting: reconnaissance, exploit customization, privilege escalation, tunneling via Chisel, and exfiltration. A custom 17,550-line tool called BACKUPOSINT.py piped harvested data from 305 SAT servers through GPT-4.1 to produce 2,597 structured intelligence reports, while the operator allegedly walked away with 195 million SAT taxpayer records and 220 million Mexico City civil records. Security Affairs had covered Gambit’s initial findings in March: the attacker posed as a bug bounty tester, and Claude called the requests to delete logs red flags before it was talked into helping anyway. Coverage from SOCRadar, SC Media, and TechRadar has the play-by-play, but the short version is that the era of “the AI did it for me” pentesting has officially gone live, and not in a good way.