Security agencies Dragos and Gambit Security disclosed that during an intrusion operation that occurred between December 2025 and February 2026, attackers used Anthropic's Claude and OpenAI's GPT to launch attacks on multiple Mexican government agencies, and at one point approached the industrial control environment related to the city's water supply system.

What makes this incident unique is not the novelty of the attack method, but the direct use of commercial AI in the intrusion process. Researchers say the attackers initially lacked experience with known industrial control systems, but once the model entered the victim's IT network, it was able to automatically identify worthy industrial assets for attack and generate subsequent steps accordingly.

The attacks extended from government agencies to water supply systems.

Research shows that attackers breached multiple Mexican government agencies over several months, stealing a large amount of government and resident data. Gambit Security recovered more than 350 attack traces during the investigation, most of which were AI-generated scripts.

The investigation then narrowed its focus to a municipal water and drainage company in the Monterey metropolitan area. Dragos stated that after the initial IT intrusion at the company in January 2026, the attackers began probing the connections between the company's IT network and its operational technology environment.

Claude autonomously identifies industry-related entry points.

Researchers say Claude identified a server hosting a vNode industrial gateway and a SCADA/IIoT management platform within the victim's network as a high-value target. The model then consulted vendor documentation, compiled default passwords and password combinations relevant to the victim, and initiated automated password spraying on single-password authentication interfaces.

This attempt ultimately failed. Dragos found no evidence that the operational technology environment had been breached. However, the investigation concluded that the process itself was more noteworthy: the model, without any human guidance on industrial control expertise, crossed the identification threshold between IT and OT, a threshold typically considered to require specialized experience.

Tool development speed has accelerated significantly.

The study also mentioned that Claude wrote a Python framework of about 17,000 lines, containing 49 modules, covering functions such as network enumeration, credential collection, Active Directory query, database access, privilege escalation, cloud metadata extraction, and lateral movement automation.

Another command and control framework evolved from a basic HTTP controller into a usable C2 system within two days. Researchers believe that AI has compressed the tool development process, which might have taken days or even weeks, into hours, allowing attackers to adapt to unfamiliar environments more quickly.

Known techniques are being automated on a large scale

Dragos pointed out that the techniques used in this operation were mostly derived from publicly available attack methods and did not demonstrate any new industrial control-specific attack capabilities. The main changes were in speed, the level of automation, and the ability of the model to continuously patch and expand the tools based on real-time feedback.

This means that the traditional approach of using "novelty of tools" to judge an attacker's skill level may no longer be sufficient. Even if the attack methods themselves are not new, AI can significantly lower the barrier for attackers to identify and probe industrial-related systems, especially after they have already penetrated the enterprise IT network.