A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report | Balens Blog
Patrik M. — Co-Founder at Guild Security | CISO at CR14
Artificial intelligence is becoming increasingly important for cyber security pros
For example, take a look at this report by Gambit Security on the case of the targeting of Mexico's government:
"The report documents, from recovered forensic materials, how two commercial AI platforms - Anthropic’s Claude Code and OpenAI’s GPT-4.1 -were used as core operational tools throughout a campaign that ran from late December 2025 through mid-February 2026. Approximately 75% of remote command execution activity was generated and executed by Claude Code. A custom 17,550-line Python tool piped harvested server data through OpenAI’s API, producing 2,597 structured intelligence reports across 305 internal servers. The attacker’s recovered materials include over 400 custom attack scripts, 20 tailored exploits targeting 20 different CVEs, and 1,088 individually logged prompts generating 5,317 AI-executed commands across 34 sessions on live victim infrastructure."
https://gambit.security/blog-post/a-single-operator-two-ai-platforms-nine-government-agencies-the-full-technical-report
3 reactions · 0 comments