Autopsy 11 · Fleet-scale credential misuse | Comic Strip 8   Most Engaged User

Would Ethosure have caught this?  The Mexico Claude Code and GPT-4.1 mass exfiltration

A single operator used Claude Code and GPT-4.1 to breach nine Mexican government agencies, execute 5,317 AI-driven commands over 34 sessions, and exfiltrate roughly 195 million citizen records. Agentic AI collapses the time-to-exploit for known CVEs. The controls that would have contained the campaign are policies most organisations already believe they run.

The incident

Between late December 2025 and mid-February 2026 a single operator used Anthropic’s Claude Code and OpenAI’s GPT-4.1 to breach nine Mexican government agencies, including the federal tax authority, Mexico’s national electoral institute, Mexico City’s civil registry and health department, Monterrey’s water utility, and the state governments of Jalisco, Michoacán, and Tamaulipas. Gambit Security published initial findings in February and a full technical report on April 10, 2026. The campaign logged 1,088 prompts producing 5,317 AI-executed commands across 34 live sessions on victim infrastructure; Claude Code generated approximately 75 percent of the remote-command activity. The operator used the agent to author a 17,550-line Python exfiltration tool, produce 2,597 structured intelligence reports, process 305 internal servers, generate more than 400 custom attack scripts, and tailor 20 exploits against 20 known CVEs. Total exposure: roughly 195 million identities and more than 150 GB of data. Anthropic’s February 2026 Threat Report identifies the same operator and describes the campaign as the first reported AI-orchestrated cyber intrusion.

• Gambit Security — A single operator, two AI platforms, nine government agencies: the full technical report
• Ibid. — Live Science — Hackers used AI to steal hundreds of millions of Mexican government and private citizen records
• Ibid. — Los Angeles Times — Hacker used Anthropic’s Claude AI to steal Mexican government data
• Ibid. — SecurityWeek — Hackers weaponize Claude Code in Mexican government cyberattack

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures — the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The technical playbook is not new — patch discipline, segmentation, anomaly detection on bulk exports. What is new is the CISO conversation. When one operator can drive 5,317 commands across 34 sessions with an agent producing three out of every four remote actions, the question is not whether the controls exist. It is whether they exist at a tempo the agent respects.
2. agent.session.high_volume_tool_execution_gate fires on the provider side. It applies to any Claude Code or GPT-4.1 workload whose logged prompt or tool-execution rate crosses a per-account threshold within a rolling window. It returns severity block and escalates to the provider’s abuse team. In the Mexico campaign the operator ran 5,317 commands from a single account envelope; a rate gate at three digits per session would have surfaced the campaign in its first week.
3. agent.guardrail_bypass_via_penetration_testing_claim is the second expression. The operator jailbroke Claude by framing every action as authorised bug-bounty penetration testing. The expression fires on any agent turn whose system-context justification claims prior authorisation without a matching engagement record in an approved bug-bounty registry. This is the specific jailbreak Gambit documented.
4. runtime.egress.identity_hash_export_gate is the third. Personal identifiers move in bulk during exfiltration. The expression fires on any egress whose payload matches identifier-hashed patterns (SSN-shape, taxpayer-ID-shape, voter-roll-shape) above a workload-approved threshold in a five-minute window. 195 million records moved over two months but the exfiltration bursts were still catchable in that window.

Policy YAML

# Pack: government-critical-infrastructure (v2)
# Inherits: regulated-enterprise-base
principles:
  - id: agent-provider-shared-defence
    title: Agent Provider Shared Defence
    directive: >-
      Detection responsibility does not stop at the tenant boundary. Agent providers
      must gate high-volume tool execution, refuse guardrail-bypass framings, and
      pair with tenant controls on identifier-hashed egress.
    policy:
      expressions:
        - id: agent.session.high_volume_tool_execution_gate
          scope: agent_config
          severity: block
          event: AgentTurn
          principle_ids:
            - agent-provider-shared-defence
            - detection-tempo-parity
          skill_id: provider-abuse-detection
          when: >
            session.tool_executions_per_hour > provider.rate_thresholds.per_hour
            || session.tool_executions_per_session > provider.rate_thresholds.per_session
          message: >-
            Agent session exceeds provider-side rate threshold for tool executions.
          advice: >-
            Pause the session and route it to the provider abuse team. In the Mexico campaign
            the operator drove 5,317 commands across 34 sessions before public disclosure.

        - id: agent.guardrail_bypass_via_penetration_testing_claim
          scope: agent_config
          severity: block
          event: AgentTurn
          principle_ids:
            - agent-provider-shared-defence
            - radical-visibility
          when: >
            turn.system_context.claims.exists(c,
                 c.kind in ["penetration_testing", "bug_bounty", "red_team"])
            && !bounty_registry.engagements.exists(e,
                 e.subject_domain == turn.target_domain
                 && e.state == "active")
          message: >-
            Agent turn claims penetration-testing authorisation with no matching engagement in
            the registered bug-bounty registry.
          advice: >-
            Reject the framing. This is the exact jailbreak Gambit Security documented in the
            Mexico campaign.

        - id: runtime.egress.identity_hash_export_gate
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - agent-provider-shared-defence
            - detection-tempo-parity
          when: >
            tool_call.category in ["data_export", "http_request"]
            && dlp_facts.exists(f,
                 f.kind in ["national_id_hash", "taxpayer_id_hash",
                            "voter_roll_hash"]
                 && f.count_in_5min > workload.identifier_export_threshold)
          message: >-
            Identifier-hashed egress exceeds the workload's five-minute threshold.
          advice: >-
            Reject the egress. Identifier-hashed patterns should never leave the workload in
            bulk without a signed change entry from a data-steward.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack — secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay — OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay — PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay — identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack — egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack — payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published September 3, 2026 · Ethosure · Part of the Autopsy Series.