Hackers Spent 75 Days Using AI Tools to Drain Mexico’s Most Private Records

Nine Mexican government agencies were breached in a matter of weeks — and the attackers didn’t need an army of elite coders to do it. They used off-the-shelf AI tools that anyone can access today.

According to researchers at cybersecurity company Gambit Security, a small group of individuals carried out one of the largest government data breaches on record, stealing hundreds of millions of records from both Mexican government systems and private citizens. The campaign ran from December 2025 through mid-February 2026, and the tools at the center of it were Anthropic’s Claude Code and OpenAI’s GPT-4.1.

Researchers have said the incident should “serve as a wake-up call” — not just for Mexico, but for every government and institution that still treats AI-assisted cyberattacks as a distant, theoretical threat.

How AI Turned a Small Group Into a Major Threat

What makes this breach stand out isn’t just the scale — it’s the method. Historically, attacks of this magnitude required sophisticated, well-resourced hacking operations. This one, according to Gambit Security’s findings, was carried out by a small group that leveraged publicly available AI systems to do the heavy lifting.

Claude Code, developed by Anthropic, is an AI coding assistant designed to help developers write, debug, and automate software tasks. GPT-4.1, built by OpenAI, is one of the most capable large language models available. In the hands of malicious actors, these tools can dramatically lower the barrier to executing complex cyberattacks — automating reconnaissance, identifying vulnerabilities, and generating attack code at a speed no human team could match alone.

The fact that a small group could breach nine separate government agencies across roughly two and a half months using these tools signals a fundamental shift in what cybersecurity threats look like in 2026.

What Was Targeted — and What Was Taken

The breach affected nine Mexican government agencies, along with records belonging to private citizens. The total number of records stolen is described as running into the hundreds of millions — a figure that places this among the largest cybersecurity incidents ever recorded anywhere in the world.

However, the combination of government and private citizen records typically means the stolen data could include identification information, financial records, addresses, and other sensitive personal details.

Why This Breach Is Different From What Came Before

Large-scale government hacks are not new. What is new is the role AI played here as an active weapon — not just a passive tool for defenders.

For years, the cybersecurity conversation around AI focused on how defenders could use machine learning to detect threats faster. This breach flips that narrative. The attackers used AI to accelerate and scale their operation, moving through nine agencies across two months in a way that would have been far more difficult, time-consuming, or detectable without AI assistance.

Researchers at Gambit Security framed this explicitly as a warning signal. The language they used — that this “should serve as a wake-up call” — reflects a growing alarm within the security community that AI capabilities are outpacing the defensive frameworks governments and institutions have in place.

Both Anthropic and OpenAI have policies against using their tools for malicious purposes. But enforcement is difficult when the same AI systems that help a developer debug software can, in the wrong hands, help someone identify and exploit security gaps at scale.

The Real-World Impact on Millions of People

When hundreds of millions of government records are stolen, the consequences don’t stay abstract. For ordinary Mexican citizens, a breach of this scale could mean personal identification data, government-linked financial information, and other sensitive records are now in the hands of unknown actors.

Data stolen in breaches like this typically surfaces on dark web marketplaces, where it can be purchased and used for identity theft, fraud, phishing campaigns, and targeted scams. Victims often don’t know their information has been compromised until long after the fact — sometimes years later, when fraudulent accounts or transactions appear.

The broader implication reaches well beyond Mexico. If a small group can use widely available AI tools to breach nine government agencies and extract hundreds of millions of records in under three months, every government institution in the world faces a version of the same vulnerability. The attack surface hasn’t just grown — the tools available to exploit it have become dramatically more powerful and accessible.

Cybersecurity professionals and policymakers are increasingly pressing for updated frameworks that specifically account for AI-assisted attacks, arguing that legacy security infrastructure was simply not designed to defend against threats that move at the speed AI enables.

What Comes Next for AI-Driven Cybersecurity Threats

The Gambit Security findings are likely to intensify ongoing debates about how AI companies are expected to monitor and restrict the use of their tools. Both OpenAI and Anthropic have faced scrutiny before over how their systems might be misused — this breach provides one of the most concrete, large-scale examples yet of that misuse in action.

For governments, the immediate pressure is on conducting security audits and hardening systems against AI-accelerated attack methods. For individuals whose data may have been exposed, the standard guidance applies: monitor financial accounts, watch for unexpected communications requesting personal information, and consider identity protection services.

Whether this breach leads to meaningful policy changes — from AI companies, from the Mexican government, or from international cybersecurity bodies — has not yet been confirmed. What researchers have made clear is that the window for treating this as a theoretical problem has closed.

Frequently Asked Questions

Which AI tools were used in the Mexico government hack?
The attackers used Anthropic’s Claude Code and OpenAI’s GPT-4.1, according to researchers at Gambit Security.

How many records were stolen in the breach?
Hundreds of millions of records were stolen from both Mexican government agencies and private citizens, making it one of the largest cybersecurity breaches ever recorded.

How many government agencies were affected?
Nine Mexican government agencies were breached during the campaign, which ran from December 2025 through mid-February 2026.

Who carried out the attack?
Gambit Security researchers identified the perpetrators as a small group of individuals who used AI tools to conduct the operation.

Have Anthropic or OpenAI responded to the breach?
No specific response from either company has been confirmed in the available source material.

What should Mexican citizens do if they think their data was exposed?