Anthropic Report: State Actors Used Claude AI to Scale Surveillance

Anthropic released a threat intelligence report on September 10, 2026, detailing how state-linked actors misused Claude AI models to automate and scale surveillance operations. The findings reveal a systemic effort by government-affiliated entities to integrate large language models (LLMs) into the machinery of state security.

According to the report, the misuse occurred between December 2025 and August 2026, involving the Claude Haiku, Sonnet, and Opus models. The activities spanned multiple regions and tactics: Iranian actors utilized the AI to develop a malicious Firefox browser extension designed to harvest user identities from social networks, while a consultant for Mali's national security authorities used the models to engineer a system that compiled individual dossiers from mobile operator data. Additionally, the report found that a Chinese state security bureau developed an internal manual specifically for utilizing AI in surveillance operations.

The Weaponization of LLMs

This discovery arrives amid intensifying global concerns regarding the "weaponization" of commercial AI by foreign adversaries. Anthropic has previously cautioned that "algorithmic secrets" are prime targets for espionage and has advocated for more stringent export controls on AI services. The goal of such controls is to prevent "distillation," where state actors use a high-performing commercial model to train their own smaller, private models, effectively bypassing corporate safety filters and terms of service.

Lowering the Barrier to Entry

These findings demonstrate that AI is significantly lowering the barrier to entry for sophisticated state surveillance by automating labor-intensive analysis. By shifting the burden of data processing and code generation to AI, state actors can scale their operations with far fewer human resources. Jacob Klein, Anthropic's head of threat intelligence, noted that these actors are effectively automating components of the intelligence apparatus.

The Security Gap

The incident highlights a critical security gap in the AI industry. While Anthropic has banned the associated accounts and strengthened safeguards for its current models, the report suggests that account banning is an incomplete solution. State actors can use commercial AI to build the initial infrastructure of a surveillance system and then migrate those capabilities to open-source models, where corporate safeguards do not exist.

Future Safeguards

As AI providers continue to refine their detection capabilities, the industry is watching whether tighter export controls or technical watermarking will be necessary to prevent the continued migration of commercial AI capabilities into state-run surveillance tools. The challenge remains that once a model helps design a system, the resulting infrastructure operates independently of the AI provider's oversight.