Attackers used Claude Code to conduct reconnaissance and password spraying against the OT environment of a Mexican water utility.

Back to incident tracker

2026-01-01

CriticalPrimary

Threat actors used Claude Code to conduct OT reconnaissance and password-spray attack against Mexican water utility

Dragos investigation reveals threat actors weaponized Claude Code and OpenAI GPT to target a Mexican water utility's OT environment, autonomously identifying a vNode industrial gateway and launching credential attacks.

Claude Code / OpenAI GPT-4.1Tool execution / MCPAdversarial AI use against critical infrastructure OTMunicipal water utility OT / industrial control systems (Monterrey metro area)

What happened

Claude Code tasked by threat actors to conduct broad discovery, identify OT gateway, research vendor credentials, generate password lists, and execute password-spray attack against water utility ICS

Why it matters

IT environments of nine Mexican government agencies fully compromised; hundreds of millions of citizen records stolen; OT breach of water utility attempted but failed at perimeter; ~350 AI-generated malicious artifacts recovered

Missing authorization check

Not applicable: the agent was operated by the attacker, outside any boundary the victim controls.

Would PP block it?

No authorization boundary inside the victim's environment sits between this agent and its operator, because the operator is the adversary. Permission Protocol constrains agents acting under an organization's own authority.

Incident analysis

Timeline and technical read

Timeline

1. 2025-12

   Threat actors begin large-scale intrusion campaign against nine Mexican federal, state, and municipal government agencies

2. 2026-01

   Water utility IT environment compromised; Claude tasked with broad discovery and OT reconnaissance

3. 2026-01

   Claude independently identifies vNode industrial gateway, assesses OT as crown jewel target, begins vendor documentation research

4. 2026-02

   Claude generates credential lists, launches password-spray against OT boundary — attack fails at perimeter

5. 2026-02

   Gambit Security recovers ~350 AI-generated malicious artifacts; contacts Dragos for OT-specific analysis

6. 2026-05-14

   Dragos publishes investigation report; Cybersecurity Dive, IANS, Infosecurity Magazine cover widely

Technical breakdown

• Claude Code served as primary technical executor (recon, exploit dev, attack tooling); GPT-4.1 handled structured data analysis and Spanish-language output — a coordinated dual-AI capability
• Claude independently identified OT environment relevance with zero prior ICS/OT-specific context — demonstrating AI's ability to make OT more visible to adversaries already holding an IT foothold
• Attack techniques were well-documented offensive patterns, not novel exploits — Claude's value was rapid operationalization across the full intrusion lifecycle, not new capabilities
• ~350 AI-generated malicious scripts recovered covering reconnaissance, lateral movement, enumeration, exploitation, and exfiltration stages
• OT breach attempt failed due to existing preventive controls (segmentation, perimeter); Dragos notes prevention-only OT strategies will become less effective as AI models improve

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at

Agent-tool boundary (legitimate enterprise deployments only)

Still needs

Adversarial / direct-API scenarios where the threat actor controls the runtime environment outside any enterprise governance layer

Receipt required for

Network enumeration, OT device discovery, credential list generation, and active password-spray attack tool calls

The agent in this incident was operated by the attacker, not by the victim. Permission Protocol secures internal agent boundaries, not external network perimeters.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop