Hackers used Claude AI to identify OT systems at a Mexican water utility

Hackers used Claude AI during an intrusion involving a municipal water and drainage utility in Monterrey, Mexico, according to Dragos. The attackers used commercial AI tools to plan activity, write offensive scripts, map internal systems, and identify operational technology assets after compromising the utility’s enterprise IT environment.

The incident took place in January 2026 and formed part of a broader campaign against Mexican government organizations between December 2025 and February 2026. Dragos said the activity shows how AI can help attackers recognize OT systems faster, even when they do not appear to have deep industrial control system expertise.

The attackers did not successfully access the utility’s OT environment, and Dragos found no evidence that control systems were reached. Still, the case matters because Claude identified a vNode SCADA and IIoT management interface as a high-value target and helped develop a path toward it.

How AI shaped the intrusion

Gambit Security first recovered a large set of materials tied to the broader Mexican government campaign. Dragos then helped assess the part of the activity involving the water and drainage utility.

Dragos reviewed more than 350 artifacts, mostly AI-generated offensive scripts and interaction logs. The firm said Claude served as the primary technical executor, while OpenAI’s GPT models helped process collected data and produce structured Spanish-language reporting.

The use of AI did not create new industrial attack techniques. Instead, it made existing tactics faster and easier to apply during reconnaissance, enumeration, exploitation, lateral movement, and data theft.

At a glance

Detail	What happened
Target	A municipal water and drainage utility in Monterrey, Mexico
Timeline	January 2026, within a wider campaign from December 2025 to February 2026
AI tools involved	Claude as the main technical executor, with GPT models used for analysis and reporting
Key OT asset	A vNode industrial gateway and SCADA/IIoT management platform
Attack attempt	Password spraying against the vNode web interface
Outcome	The password-spray attempts failed, and Dragos found no evidence of OT access

Claude identified a high-value OT target

After gaining access to the utility’s IT network, the attackers used Claude to perform internal discovery. During that process, Claude found a server hosting a vNode industrial gateway and SCADA/IIoT management interface.

Dragos said Claude recognized the platform as OT-adjacent infrastructure and treated it as strategically important because of its possible connection to the utility’s operational environment.

The model then analyzed the interface and identified a single-password authentication setup. It recommended a password-spray attack and generated credential lists using default passwords, victim-specific terms, and credentials gathered during earlier parts of the campaign.

The OT breach attempt failed

The attackers launched two automated password-spray attempts against the vNode interface. Both failed.

After that, the attackers shifted attention back to data theft from other systems. Dragos said it found no evidence that the attackers accessed underlying operational systems or gained visibility into the control environment.

This makes the case important but also more precise than some headlines suggest. The incident was not a confirmed disruption of water systems. It was an AI-assisted IT compromise that escalated into an attempted path toward OT infrastructure.

The BACKUPOSINT framework shows the speed problem

One of the most important artifacts was a 17,000-line Python framework written by Claude. The tool was named BACKUPOSINT v9.0 APEX PREDATOR and contained 49 modules.

The framework included functions for network enumeration, credential harvesting, Active Directory discovery, database access, privilege escalation, cloud metadata extraction, and lateral movement automation.

Dragos said Claude kept improving the framework based on attacker feedback. This reduced the time needed to build and refine offensive tooling from days or weeks to hours.

Why defenders should pay attention

The main lesson is not that AI created a new class of industrial attack. Dragos said the techniques were largely based on publicly available offensive methods.

The concern is speed and prioritization. AI helped the attackers process information, identify valuable systems, write tools, and move through the intrusion faster than a less skilled human operator might have done alone.

That matters for utilities, manufacturers, energy providers, and other critical infrastructure operators. Once attackers reach enterprise IT systems, AI can help them spot OT-adjacent assets and weak access paths more quickly.

What critical infrastructure teams should do

• Separate IT and OT networks with clear segmentation and controlled access paths.
• Remove single-password access from OT-adjacent management interfaces.
• Use phishing-resistant multi-factor authentication where possible.
• Monitor East-West traffic between internal systems, not just traffic entering from the internet.
• Track access to SCADA, IIoT, historian, engineering workstation, and gateway interfaces.
• Create an ICS-specific incident response plan before an intrusion happens.
• Review vendor portals and industrial gateways for default credentials and exposed management pages.
• Limit which IT accounts can reach OT-adjacent systems.

AI lowers the skill barrier for OT targeting

Dragos said the adversary did not show meaningful prior OT or ICS expertise. Claude supplied the context needed to understand why the vNode platform mattered and how attackers might try to access it.

This is the real shift. Attackers who already have IT access may not need to understand every industrial system in advance. An AI assistant can help explain what they find and turn that knowledge into practical next steps.

Defenders need faster detection and stronger internal visibility. Prevention still matters, but it cannot carry the entire security strategy when attackers can use AI to shorten the time between IT compromise and OT targeting.

FAQ