AI: Mistral at the heart of the French response after the cyberattack against the tax administration

The hacking of the Directorate General of Public Finances pushes the French state to review its cybersecurity strategy. Faced with the flaws that hit administrations and expose sensitive data, the executive wants to significantly strengthen its digital audits using AI. A response commensurate with a threat which now goes beyond public systems alone. The stolen information can fuel social engineering campaigns and directly target citizens, including crypto holders. Behind this shift is also a major question: that of French digital sovereignty.

The sovereign response of Bercy and the exclusive choice of AI from Mistral AI

This Tuesday, August 18, 2026, following the Council of Ministers in Paris, the French government made a major technological shift to strengthen the resilience of its IT infrastructures, while nearly 700,000 taxpayers are threatened after a cyberattack against the DGFiP. The Minister of the Budget, David Amiel, announcement that the state would use artificial intelligence-based tools to proactively identify and test vulnerabilities in its own public services.

To carry out this delicate offensive audit mission, France made the deliberate choice to sideline the American giants in favor of local players. David Amiel was particularly categorical in front of the press. He has declared that the government would call on so-called sovereign AI companies, “such as Mistral”before explicitly specifying: “this excludes OpenAI”.

This political orientation is a direct extension of the program “Our AI” unveiled a few months earlier by the Ministry of the Budget. This plan already aimed to deploy sovereign tools within state services, particularly through “The Assistant”a system designed by the interministerial digital department (DINUM), based on the model of the Parisian gem Mistral AI and hosted exclusively in SecNumCloud certified data centers.

By entrusting the detection of its security vulnerabilities to Mistral, a company supported by the equipment manufacturer ASML, Paris refuses to expose the mapping of its IT weaknesses to non-European technologies. This choice of preventive engineering comes as a direct response to the shock caused by the infiltration of tax servers, made official a few days earlier.

To understand the scope of this institutional orientation, three fundamental pillars now structure the government’s new audit doctrine:

• The exclusive use of local nuggets: the State mandates French players like Mistral AI to audit its own systems without depending on American players;
• The firm exclusion of third-party models: the decision formally excludes OpenAI in order to avoid any transfer of vulnerability maps to servers subject to extraterritorial legislation;
• Anchoring in certified infrastructures: integration is based on the program “Our AI” and hosting in data centers under the SecNumCloud label.

A gaping IT gap at the General Directorate of Public Finances

The trigger for this government reorganization lies in a security breach of unprecedented magnitude at the General Directorate of Public Finances (DGFiP). Revealed the previous Thursday using on-chain data by the Ministry of Economy and Finance, the attack allowed a hacker to access the taxpayer search tool by compromising internal VPN access using stolen credentials.

The intrusion, detected and closed at the end of June 2026, led to the exfiltration of the files of nearly 700,000 people, including names, full contact details, tax access numbers, withholding tax rates and correspondence histories. The situation worsened further on Monday when the Director General of the DGFiP, Amélie Verdier, confirmed that her teams had just discovered a second data leak, currently being evaluated.

Although the tax administration has clarified that the passwords and login credentials were not stolen, the nature of the information proves particularly toxic when it crosses the crypto financial ecosystem. Leaked physical addresses and detailed tax data provide an ideal breeding ground for ultra-targeted phishing and identity theft.

This vulnerability echoes concerns expressed earlier in the year by Pavel Durov. In April 2026, the founder of Telegram publicly pointed out the flaws in public records by revealing that France had recorded 41 kidnappings or extortion attempts targeting crypto holders during the first three and a half months of the year.

Between the ambition of sovereignty and the imperative of data protection

Beyond the emergency response provided by Bercy, this partnership with the local ecosystem raises important questions about the future management of European critical infrastructures. By refusing to supply American models with the repertoire of public administration flaws, France is attempting to impose a strict confidentiality standard under the control of European law.

However, this method of automated testing by sovereign AI will have to prove its effectiveness in the face of human operating methods often based on the compromise of legitimate identifiers, a breach that algorithmic code analysis is not always enough to plug. The confrontation between the analytical power of large language models and the reality of human risk promises to be decisive.

In the future, the French reaction could set a precedent within the European Union regarding the obligation to audit critical systems via artificial intelligence strictly confined under local legal sovereignty. However, if Mistral AI’s technology offers guarantees against the leak of information to third parties, it cannot retroactively erase the hundreds of thousands of taxpayer files now in circulation. For investors and holders of capital, the urgency no longer lies only in the technical security of their portfolios, but in permanent vigilance in the face of attempts at social engineering, made fearsomely effective by the involuntary exposure of their administrative identity.