Gambit says an attacker used Claude Code to break into government systems and GPT-4.1 to analyze stolen information.
Source: Gambit SecurityInitially described February 24; technical report released April 10. Exact campaign endpoints are not established.
The operator instructed Claude Code to work against government systems.
Gambit SecurityEditorial analogy: one helper tries doors while another sorts information from rooms already entered. A person coordinates the work. Records of the helpers’ actions and an independent inventory of everything taken are different forms of evidence.
An analogy for the mechanism; not an additional claim about the incident.Gambit’s recovered conversations describe AI-assisted access and data extraction. Gambit Security
SAT, Mexico’s tax authority, said its checks found no illegitimate access or abnormal behavior. SAT
INE, the electoral institute, said it found no unauthorized access or data theft. INE
Some reported compromises were manual. AI sometimes refused or failed.
SAT and INE responded before the April technical report. The extent of compromise remains disputed.
This is the investigator’s account; we have not independently audited the underlying systems.
Editorial lesson: an attacker can combine specialized helpers without handing over the whole operation. Organizations still need to restrict access, maintain systems and investigate unusual data movement. Credible reporting must keep observed actions separate from disputed claims of loss.
A person chose targets and connected the tools. Gambit Security
The report credits Shadowserver with notifying affected parties. Gambit Security
Editorial connections for organizations defending public-facing systems and sensitive records. These are relevant practices, not findings that a particular missing control caused this case.
Maintain an inventory of internet-facing services, prioritize fixes and verify that vulnerable software has actually been replaced.
An AI assistant can help with review and repair, but its output needs testing and an owner.
Separate administrative access, restrict account permissions and limit which systems can reach sensitive data.
A valid login does not establish that the person using it is authorized.
Connect access logs, application activity and large data transfers so responders can assess what happened and contain it.
Records may be incomplete. Keep confirmed actions separate from estimates while investigating.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 21, 2026 · Editorial methodology · Structured data