{
 "public_id": "AIR-2026-0050",
 "incident_id": "2025-12-claude-assisted-mexico-government-data-theft",
 "date_disclosed": "2026-02-25",
 "date_occurred": "2025-12",
 "title": "An attacker prompted Claude to find vulnerabilities and write exploitation scripts against Mexican government networks, contributing to theft of 150 GB of citizen data",
 "class": "in_the_wild",
 "attack_surface": "other",
 "initial_vector": "jailbreak_guardrail_bypass",
 "agent_capability_abused": [
  "vulnerability_identification",
  "exploit_script_generation",
  "attack_automation_planning"
 ],
 "target_product": "Claude",
 "target_vendor": "Anthropic (abused); Mexican government agencies (victim)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_exfiltration",
  "privacy_violation"
 ],
 "blast_radius": "150 GB of taxpayer, voter, government employee and civil-registry data across Mexican government agencies, over roughly a month",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "jailbreak",
   "persona_roleplay",
   "nation_scale_pii",
   "capability_uplift",
   "non_english_prompting"
  ]
 },
 "defense_present": "Anthropic safety training and misuse detection",
 "defense_bypassed": true,
 "fix_shipped": "undisclosed",
 "primary_sources": [
  "https://gambit.security/blog-post/prevention-has-lost-its-edge-resilience-is-the-winning-play",
  "https://incidentdatabase.ai/cite/1430"
 ],
 "verified_quote": "The unknown Claude user wrote Spanish-language prompts for the chatbot to act as an elite hacker, finding vulnerabilities in government networks, writing computer scripts to exploit them and determining ways to automate data theft, Israeli cybersecurity startup Gambit Security said in research published Wednesday.",
 "confidence": "high",
 "notes": "Research by Gambit Security, reported by Bloomberg. Two details worth carrying: the jailbreak was a Spanish-language roleplay frame, which is a recurring gap between English-centric safety evaluation and multilingual deployment; and the model was used across the whole chain — discovery, exploitation, automation planning — rather than for one step. Victim data is national-scale civil registry and tax records. AI Incident Database incident 1430.",
 "risk_category": "privacy",
 "risk_secondary": [
  "product_misuse"
 ],
 "risk_subcategory": "PII Leakage",
 "risk_sub_secondary": [
  "Data Exfiltration via Context"
 ],
 "ai_entity": "generative",
 "agency": "human_acted_on_output",
 "agency_debatable": true,
 "agency_reason": "Claude found vulns and wrote scripts; the attacker ran them",
 "vector_family": "direct_prompt_injection",
 "vector_detail": "jailbreak_guardrail_bypass",
 "guardrail_kind": [
  "abuse_detection"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1430
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: PII Leakage",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI01 (vector_family=direct_prompt_injection); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}