Anthropic’s AI Misuse Report Shows Claude in Surveillance and Influence Operations

*This analysis covers Anthropic's September 10, 2026 threat-intelligence report and related policies. The case studies are based primarily on Anthropic's internal visibility and attribution; they are not an independent census of AI-enabled abuse.*

Anthropic says it identified and disrupted malicious use of Claude between December 2025 and August 2026 across cyber operations, influence campaigns, non-consensual surveillance, scams and fraud, biological misuse, conventional-weapons development, and illicit model distillation. The report describes actors using AI not only to write content but to build software, analyze targets, translate and impersonate, prepare technical documents, and coordinate longer operational workflows.

The central trend is labor compression. Anthropic reports cases where a single operator used Claude to perform work that previously required engineering or analyst teams. But the document covers activity Anthropic detected on its own service; it cannot show the total prevalence of misuse, everything actors did elsewhere, or how often safeguards stopped harmful requests before a case escalated.

The report spans seven harm categories. Examples include fake social profiles and news sites used in influence operations, software for mass surveillance and identity harvesting, fraud workflows, prohibited biological research assistance, weapons-related engineering and documentation, cyber activity, and attempts to extract model behavior through distillation.

In surveillance cases, Anthropic says actors used Claude to turn bulk social posts into structured profiles containing inferred location, demographics, and political views. In influence cases, operators produced coordinated personas and deceptive content for audiences across multiple continents. Some weapons cases involved simulation, firmware, targeting, or procurement work, though Anthropic explicitly notes important uncertainty about attribution and whether several systems became operational.

No. Human actors supplied objectives, domain knowledge, data, access, hardware, and external infrastructure. Claude accelerated portions of planning, coding, analysis, translation, documentation, or iteration. The report does describe more agentic use, including writing directly to project files and supporting multi-step workflows, but that is different from an autonomous system choosing the operation.

This distinction does not make the risk trivial. Reducing the people, time, language ability, or specialist knowledge needed for harmful work can change who is capable of attempting it. It does mean readers should avoid turning vendor case descriptions into claims that a chatbot independently ran a state operation.

Anthropic says it banned associated accounts, strengthened detections using observed behavioral signatures, and shared indicators with authorities and industry partners where appropriate. Its Usage Policy prohibits areas including non-consensual surveillance, weapons development, fraud, and violations of civil liberties.

The report also exposes a control gap: in one described cluster, Claude refused explicit profiling and propaganda prompts but did not refuse many software-building requests that supported the same surveillance operation. Intent can be fragmented across innocuous-looking subtasks, so filters at the prompt level are not enough.

Govern the whole agent system. Give models distinct identities, least-privilege credentials, allow-listed tools and destinations, limits on steps and spending, logging that captures actions as well as chat, and human approval before bulk outreach, account creation, surveillance-like profiling, code deployment, or physical-world changes.

Security teams should look for behavior across sessions: unusual volumes, repeated persona creation, bulk targeting, attempts to evade geographic controls, sensitive tool combinations, and workflows deliberately divided into small pieces. Providers and customers also need incident-response paths that can revoke credentials and share indicators without exposing unrelated user data.

Anthropic's report provides unusually concrete evidence that AI assistants can compress parts of real malicious workflows across several domains. Its most useful lesson is not that one model is uniquely dangerous; it is that general coding, language, research, and tool-use capabilities become dual-use when connected to data and action.

The evidence also has limits. This is a vendor-authored sample of detected activity, not a denominator-based measurement of misuse or an independent audit of Anthropic's controls. Organizations should use it to improve system-level defenses while demanding comparable reporting, clearer metrics, and external scrutiny across the industry.