Hackers Use Claude and ChatGPT to Target Mexican Government, Exposing More Than 100 Million Confidential Records

Municipal water supply and drainage systems managed by Mexican government agencies are critical infrastructure. A breach could disrupt household water supplies and wastewater treatment and threaten public safety. The incident involving Anthropic’s Claude and OpenAI’s GPT highlights how generative AI can improve efficiency while also lowering the barriers to planning and carrying out cyberattacks.

The latest investigation found that hackers used Claude and GPT to map infiltration routes, assess the significance of Mexican water-sector targets and develop automated attack scripts aimed at government-run water supply and drainage systems. However, available information did not specify the exact date of the breach, the number of cities affected, the financial losses or the scale of any system outages.

Anthropic’s Claude has become a widely used generative AI platform for writing, research and software development, with paid accounts providing access to metered computing capacity. Cybercriminals are increasingly targeting browser cookies and authenticated sessions rather than passwords. A stolen session can let an attacker impersonate a user after login, bypassing the practical protection offered by a password and two-factor authentication.

Anthropic has warned that multiple strains of information-stealing malware are harvesting Claude credentials and active browser sessions. Attackers can reuse a valid session to take over an account without entering a password or completing 2FA, then consume the victim’s paid AI allowance. Reports of unexpectedly depleted usage quotas have brought attention to the campaign and the need to revoke all active sessions and remove malware from affected devices.