In the wild
Realized harm
An attacker prompted Claude to find vulnerabilities and write exploitation scripts against Mexican government networks, contributing to theft of 150 GB of citizen data
AIR-2026-0050 AIR record · 2025-12-claude-assisted-mexico-government-data-theft
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The unknown Claude user wrote Spanish-language prompts for the chatbot to act as an elite hacker, finding vulnerabilities in government networks, writing computer scripts to exploit them and determining ways to automate data theft, Israeli cybersecurity startup Gambit Security said in research published Wednesday.gambit.security
The record
Disclosed
2026-02-25
Occurred
2025-12
Vendor
Anthropic (abused); Mexican government agencies (victim)
Product
Claude
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Human acted on output (contested) — Claude found vulns and wrote scripts; the attacker ran them
Attack surface
Other
Autonomy level
Semi-autonomous
Initial vector
Jailbreak guardrail bypass
Impact type
Data exfiltration, Privacy violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
150 GB of taxpayer, voter, government employee and civil-registry data across Mexican government agencies, over roughly a month
Capability abused
Defense & remediation
Recorded defense
Anthropic safety training and misuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
undisclosed
Taxonomy & references
Curator notes
Research by Gambit Security, reported by Bloomberg. Two details worth carrying: the jailbreak was a Spanish-language roleplay frame, which is a recurring gap between English-centric safety evaluation and multilingual deployment; and the model was used across the whole chain — discovery, exploitation, automation planning — rather than for one step. Victim data is national-scale civil registry and tax records. AI Incident Database incident 1430.
Supporting sources
Cite as
Enkrypt AI. "An attacker prompted Claude to find vulnerabilities and write exploitation scripts against Mexican government networks, contributing to theft of 150 GB of citizen data". AIR, AIR-2026-0050. https://agentincident.vercel.app/i/AIR-2026-0050/ (accessed 2026-10-19).