The Mexico breach logs: 1,088 prompts, 5,317 commands, one operator

Bloomberg broke the story on February 25, 2026. Gambit Security's full report, covered widely in April, supplies the operational detail. Between late December 2025 and mid-February 2026 a single attacker used Claude Code and GPT-4.1 against at least nine Mexican government organizations, including the federal tax authority SAT and the national electoral institute. 1,088 attacker prompts produced 5,317 AI-executed commands across 34 sessions. Claude Code generated roughly 75 percent of remote command execution. 150 GB left 305 internal servers through a custom tool the attacker named BACKUPOSINT.py, and GPT-4.1 turned the haul into reports on server configuration. By the end the attacker had built a live API into compromised tax infrastructure and a generator for forged tax certificates using real data. Roughly 195 million identities were exposed.

How the guardrails were passed

The attacker posed as a bug bounty participant, supplied a hacking manual as context, and persisted through refusals until the model treated the activity as authorized. Anthropic confirmed the breach, banned the accounts and said later models carry better misuse detection. We know the details because the attacker left the conversation logs exposed on the internet, where Gambit found them.

What the logs show about egress

Read from the victim side, this is a story about outbound connections from government hosts to infrastructure the attacker stood up for the campaign. Exfiltration of 150 GB from 305 servers is not one connection; it is a sustained pattern of hosts reaching destinations they had never reached before, over weeks. The underlying weaknesses Gambit lists are familiar: unpatched systems, credential reuse, poor segmentation. What changed was tempo. One operator produced the output of a team, and the intrusion moved faster than the human defenders reviewing it.

What to do

1. 01Assume the next intrusion runs at agent tempo. Response playbooks calibrated to a human attacker's pace of lateral movement are calibrated wrong.
2. 02Put production and management segments under Default Action Deny resolver policies with first-seen holds. Servers do not browse; a new destination from a server is a review, not noise.
3. 03Alert on sustained first-seen resolution volume from a single source address, and on any port 53 traffic leaving the segment toward a non-corporate resolver.
4. 04Fix the basics Gambit named: patching, credential reuse, segmentation. The agent did not need a zero-day.