Twenty-five million SIM cards on three mobile operators, and a single Bamako consultant using Claude as the engineering workforce for the platform that watches them. That is Anthropic’s Mali case in the September 2026 surveillance section, and it states the thesis without metaphor: the model replaces staff, not merely answers questions.[1]
The Claude Misuse Files, Part 4 stays inside Anthropic’s surveillance chapter (January-July 2026 disruptions). Anthropic describes state-aligned actors, contractors, and commercial spyware vendors from China, Iran, and West Africa building and running monitoring systems on Claude, then bans, detections, and partner sharing where impacts left the platform.[1] Where a fact appears only in that report, it is labelled Anthropic-only. External enrichment is thinner here than in the cyber and influence parts; Forbidden Stories’ earlier S2T brochure reporting is the main public parallel cited below.[2]
Three trends Anthropic names
First, AI in place of an engineering workforce. Anthropic’s examples: a Malian consultant designing a mass-interception platform; Iranian actors shipping a malicious Firefox extension that harvested social-network identities; a PRC religious-affairs collection desk reduced, in Anthropic’s phrasing, from many analyst teams to a single office producing thousands of investigations a month with an AI assistant.[1]
Second, bulk ingestion to identify targets. Anthropic-only: batches of social posts turned into structured records with location, demographics, political leanings, and confidence scores; an Iranian unit analysing hundreds of thousands of posts and selecting thirty-nine opposition accounts to monitor; PRC actors scoring content for political sensitivity and flagging targets for “control”; a PRC-aligned operator with no Arabic running a multi-day Uyghur recruitment approach in Syria with dialect drafting, live translation, and “expert” role-play quality checks.[1]
Third, integration into security bureaucracy. Anthropic-only: a PRC state security bureau producing an internal manual on AI use in surveillance; two Iranian units that shared no code or personnel independently using Claude to fix the same technical and usability problems on a central case-management system named “Arman.”[1] Targets, Anthropic notes, were the diaspora and dissident communities these regimes have historically pursued: Hong Kong pro-democracy figures, Tibetan and Falun Gong communities, Iranian minorities and opponents abroad.[1]
Commercial profiling: GTG-54009 and S2T
In June 2026 Anthropic banned an account building a commercial platform to analyse and profile social media users in Iran and the Persian Gulf. Anthropic assesses the work as carried out by or for “S2T Unlocking Cyberspace,” which open-source research treats as an Israeli-Singaporean commercial intelligence vendor.[1] Anthropic-only on the Claude workstream: batches of roughly twenty-five posts scored into demographic groups (urban, clerical, military, youth, diaspora, rural), locations, and political leanings; Arabic briefings styled as government reports with sentiment by Gulf nationality and recommended counternarratives; a secondary stock of more than 255 synthetic social accounts for later deployment. Anthropic says it caught the activity in pilot stage and found no evidence later stages hit real targets before the ban.[1]
Anthropic states that its findings independently corroborate Forbidden Stories’ February 2023 investigation of an S2T brochure in leaked Colombian military files. That brochure, as Forbidden Stories reported, marketed tools beyond ordinary OSINT (open-source intelligence): automated phishing to install malware, advertising databases for tracking, and influence operations via fake accounts, including pitches that listed “anti-government activists” among target classes.[1][2] Anthropic could not independently confirm the downstream stages Forbidden Stories described.[1]
China desk work: recruitment, religion, “stability maintenance,” yùqíng
GTG-14010 (Anthropic-only): a PRC government-aligned operation used Claude to convert chatter from over a hundred WhatsApp groups and dozens of Telegram channels into Chinese-language profiles of Uyghurs and Uyghur armed formations in Syria, flagging financial stress, family separation, and relatives still in Xinjiang; to run covert recruitment scripts in Syrian Arabic; to geolocate businesses; and to plan suppression of Uyghur diaspora media, notably the Uyghur Post. Anthropic assesses with low confidence a contractor for PRC state security rather than a direct organ, and notes Claude declined several requests for covert interrogation and large-scale persona cultivation.[1]
GTG-14020 (Anthropic-only): a religious-affairs intelligence desk produced Chinese dossiers on Catholic cardinals across Asia, Taiwanese Presbyterian leadership, Tibetan exile administration and advocacy groups, and Falun Gong-linked media, using internal templates for “personnel research drafts,” “clue reports,” and “situational awareness” digests with fields for scandals and exploitable zhuāshǒu (“grab handles”). Coverage spanned WeChat, Xiaohongshu, Douyin, Weibo, LinkedIn, Instagram, Threads, X, and Facebook on a daily cycle, with prompts instructing Claude to adopt “China’s standpoint.”[1]
GTG-14021 (Anthropic-only): three linked “stability maintenance” (维稳) operations from municipal public and state security orbits. A cyber police unit ran sentiment pipelines via Claude Code and custom skills against a government surveillance database; a police-academy student case produced suppression guidance naming ten private citizens for “control” after an initial refusal was overcome on re-prompt; a local bureau (Anthropic: likely Zhejiang, medium confidence) wrote daily templatized briefings and an AI usage manual, and requested pre-operational venue detail for overseas protests (Vancouver march points, Uyghur cultural venues in Turkey, Oslo Freedom Forum screenings).[1] Anthropic is frank that safeguards did not perform uniformly: one refusal reversed; another case complied across many sessions.[1]
GTG-14022 (Anthropic-only): a contractor-facing “public opinion monitoring” (舆情) pipeline processed fifteen to thirty-plus foreign articles a day into government-style briefings, with political-sensitivity scores, scare quotes around terms such as “human rights violations,” terminology swaps (“Taiwan authorities”), and recommendations that only a state could execute, framed in “three warfares” language. Anthropic assesses medium confidence of a commercial contractor for state-security or united-front clients.[1]
Iranian Arman units and Mali’s Lakana 360
GTG-34007 (Anthropic-only): sixteen accounts across two linked units associated with Iranian paramilitary and domestic security agencies. One built and shipped tools including a messenger de-anonymizer, phone-to-identity resolver, national-ID phishing page, Telegram mass-report bot, and a Firefox harvester branded “al-Najm al-thāqib” as a prayer-times utility. The other built a web front end for “Arman,” a federated case-management system logging national ID, beliefs, criminal record, social accounts, and an “action” tab, and ran analysis over 155,216 tweets that named thirty-nine opposition and diaspora accounts. Anthropic assesses high confidence of association with Iranian paramilitary domestic security, and notes one unit claimed to profile 6,388 Iranians in a year. Claude refused some explicit profiling and propaganda asks; many tooling requests still went through.[1]
GTG-50027 (Anthropic-only): a Bamako-based consultant for Mali’s Agence Nationale de la Sécurité d’État used Claude to design “Lakana 360,” aimed at roughly twenty-five million SIMs across all three national mobile operators, with call, SMS, and voice capture, voiceprint tracking across SIMs, VPN and encryption flagging, geofenced watch lists, and joins to the national biometric registry. Anthropic says the warrant requirement was removed, at the operator’s request, from the LLM dossier component on any phone number, with indefinite retention. The platform ran on-premises with local models; account bans disrupted design work on Claude, not the deployed product.[1] Anthropic cites Human Rights Watch reporting on Malian security services’ detention of opposition figures, journalists, and civil-society members as context for risk.[1][3]
Precision, and a labelled gap
This essay is denser with Anthropic-only facts than Parts 2 and 3 because the public record around these particular cases is thinner. Forbidden Stories’ S2T brochure work is the clear external match for GTG-54009.[2] Same-day press paraphrases of the September report (SiliconANGLE, The Register, CNBC) repeat Anthropic’s surveillance scope without adding independent TTPs (tactics, techniques, and procedures); treat them as reception, not second investigations.[4] For the PRC desks, Iranian Arman tooling, and Mali’s Lakana 360, the September report is presently the primary technical disclosure.[1] The understatement still holds. Surveillance here is not a vague claim that “AI watches everyone.” It is software engineering, dossier templates, and warrant-free narrative generation on phone numbers, done by people who already had the mission and needed fewer analysts to keep it running.
Notes
[1] Anthropic, “Detecting and countering misuse of AI: September 2026,” published 10 September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026
[2] Forbidden Stories, “When your ‘friends’ spy on you: The firm pitching Orwellian social media surveillance to militaries,” 28 February 2023. https://forbiddenstories.org/osint-s2t-unlocking-cyberspace-journalists-activists/
[3] Human Rights Watch, “Mali: AU Action Needed To End Crackdown on Opposition, Dissent,” 13 February 2025. https://www.hrw.org/news/2025/02/13/mali-au-action-needed-end-crackdown-opposition-dissent
[4] SiliconANGLE, “Anthropic says AI now lets lone operators run state-level hacking campaigns,” 10 September 2026. https://siliconangle.com/2026/09/10/anthropic-says-ai-now-lets-lone-operators-run-state-level-hacking-campaigns/