Recently surfaced
Four thousand seven hundred AI personas, at least twenty-five thousand unique people messaged, and a swipe feed that was three-quarters bots. That is Anthropic’s count for GTG-15001 over a two-week window in April 2026, and it is enough to open the fraud file without a slogan. The Claude Misuse Files, Part 5 takes Anthropic’s scams-and-fraud […]
→Twenty-five million SIM cards on three mobile operators, and a single Bamako consultant using Claude as the engineering workforce for the platform that watches them. That is Anthropic’s Mali case in the September 2026 surveillance section, and it states the thesis without metaphor: the model replaces staff, not merely answers questions. The Claude Misuse Files, […]
→Seventy fabricated news sites, paired X accounts, and more than two hundred commenting sock accounts (fake profiles that reply under real posts), all traced by Anthropic to a France-based advertising firm that sold narrative by the client. That is LKM Company’s footprint in the September 2026 report, and it is also the cleanest picture of […]
→Twenty organisations on a targeting list, and a hotel Wi-Fi page that answered DNS for someone else. That is the working image for Anthropic’s cyber section in September 2026: humans still choose the prey; agents run the rest of the kill chain. The Claude Misuse Files, Part 2 stays with that claim. Anthropic’s report treats […]
→Almost 300,000 customer requests in ten days, relayed through 5,380 fraudulent accounts, shown to users as if they had come from Moonshot’s own Kimi model. Between May and July 2026 Anthropic attributes more than 23 million exchanges to that same campaign. The number is not a vanity metric. It is a claim that another lab’s […]
→In May 2026 Anthropic’s biological safety classifier blocked a grant-writing request about gain-of-function work on chikungunya virus. The investigation that followed found the request would have ridden an LLM platform serving dozens of life-sciences researchers, tunnelling traffic through US infrastructure and a zero-data-retention channel, with a fallback that sent Claude refusals to a competitor’s more […]
→Within hours of a guided-rocket test fire in northern Yemen, the same operators were back in Claude asking why it had failed. That sentence, from Anthropic’s September 2026 threat-intelligence report, is the whole argument of this essay compressed into a timeline. The model was not a brochure writer. It was sitting inside a software-in-the-loop path […]
→On 31 July 2026, Microsoft Threat Intelligence published a campaign note under the name CaptiveCrunch. It described traffic manipulation on hospitality captive-portal networks: DNS and HTTP redirected so that a guest joining hotel or conference Wi-Fi could be steered into lookalike Microsoft sign-in pages, device-code authentication traps, or fake browser and OS updates. Microsoft attributed […]
→