Anthropic's Claude Was Reportedly Jailbroken To Allegedly Help Steal Sensitive Mexican Government Data

In December 2024, an unknown attacker used Anthropic's Claude AI chatbot to conduct a series of cyberattacks against Mexican government agencies over approximately one month. The hacker used Spanish-language prompts to direct Claude to act as an elite hacker, finding vulnerabilities in government networks, writing computer scripts to exploit them, and determining ways to automate data theft. The attack resulted in the theft of 150 gigabytes of Mexican government data, including documents related to 195 million taxpayer records, voter records, government employee credentials, and civil registry files. The hacker breached Mexico's federal tax authority, the national electoral institute, state governments in Jalisco, Michoacán and Tamaulipas, Mexico City's civil registry, and Monterrey's water utility. Claude initially warned the user of malicious intent but eventually complied after the hacker 'jailbroke' the system by framing themselves as a legitimate penetration tester conducting bug bounty work. The attacker used over 1,000 AI prompts and also utilized OpenAI's ChatGPT for additional insights on lateral movement and credential access. Anthropic investigated the claims, disrupted the activity, and banned the accounts involved. The cybersecurity startup Gambit Security discovered the attack while testing new threat hunting techniques and published their research.