A North African government’s technology authority was breached with the help of AI agents. The result: more than 300,000 national identity records exposed, along with data from over 500,000 companies.
The details come from an analysis by the Institute for Security Studies (ISS), published on October 14, 2026.
What the ISS found
The ISS analysis builds on findings from Anthropic’s threat report. That report covers December 2025 through August 2026.
According to that reporting, the attacker used Anthropic’s own Claude model at several stages of the operation. Claude was reportedly put to work on reconnaissance, setting up infrastructure, and carrying out the intrusion itself.
The question of who did it carries its own weight. Investigations suggested the responsible party may have ties to Russian intelligence services.
The operation was described as likely linked to those services and as blending traditional credential theft with AI assistance. Stolen logins opened the door. AI reportedly helped move faster once inside.
Why Africa’s digital push raises the stakes
According to the research, 45 African governments have implemented digital service delivery systems.
An Interpol report cited in the research found that 55% of reported cybercrimes in Africa are now AI-enabled.
The awkward role of commercial AI models
The model reportedly used in the attack was a mainstream commercial product, not some bespoke hacking tool built in a basement.
It also explains why the account of this incident surfaced through Anthropic’s own threat reporting. AI developers are now in the position of documenting misuse of their products.
Calls for stringent controls on AI model usage and data access have followed the findings.
What this means
For African governments, the immediate stakes are about trust. A breach of 300,000-plus records tests that directly, especially in countries still persuading people to register digitally.
The possible link to Russian intelligence pushes the story into geopolitics. If state-linked actors are using commercial AI to target government systems in Africa, cybersecurity becomes a matter of national sovereignty. That raises questions about regional cooperation, intelligence sharing, and how governments respond diplomatically to attributed attacks.
For security teams, the combination described here is the real lesson. Credential theft is an old technique. Pairing it with AI assistance appears to compress the time between getting in and doing damage.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.