Spying on 25 million lines and a fake NGO: how authoritarian regimes used Claude, according to Anthropic

By Zendoric · September 14, 2026.

Anthropic says it has dismantled a series of surveillance and disinformation campaigns driven by authoritarian regimes and state operators that used its Claude model as a working tool. The company lays this out in a 154-page report on emerging threats, covered by The Globe and Mail, documenting cases in Mali, the Central African Republic and Sudan that were detected and blocked over the past eight months, with additional activity in Asia, Russia and Europe.

In Mali, according to the report, a consultant for the country's intelligence services —ruled by a military junta since the coups of 2020 and 2021— used Claude as its "main engineering workforce" to build a mass surveillance system that illegally spied on SIM cards from the three national mobile operators: 25 million lines. The system intercepted text messages and calls, and used the model to draft intelligence dossiers on the targets, circumventing Malian law, which requires a court order for this type of surveillance.

In the Central African Republic, Anthropic links a Russia-backed operator —connected, according to the report, to Politology, an influence agency controlled by Russia's foreign intelligence service— to a media manipulation operation designed to look local. They used Claude to generate daily content for a radio station in Bangui with pro-Moscow and anti-French messaging, as well as to monitor opposition politicians, forge government documents and write scripts for senior government officials.

In Sudan, the report attributes —"with high confidence," according to Anthropic's own investigation, though without public judicial proof— to an operator with ties to United Arab Emirates government officials the creation of a network of some 300 fake accounts and a fictitious NGO that copied the identity of a real Swiss organization in order to publish human rights reports written by the state itself. The network went as far as using Claude to write the testimony that two people were to deliver before the UN Human Rights Council as though they were independent local witnesses, and it compiled dossiers on 18 members of the European Parliament, prominent journalists and UN special rapporteurs critical of the UAE's role in the Sudanese conflict.

The same report —also covered by Japan Today— groups these three episodes of state surveillance together with other cases of misuse for weapons development, spyware and AI-enabled scams. The company frames the set as examples of "the most notable and novel threat activity" detected so far, and closes with a warning: "as models become more capable, their risks will increase, unless AI developers and society's defenders act to make them safer".

It is worth separating the verifiable from the narrated. Anthropic is both judge and party: it is the only public source for these attributions, and there are no court files or independent verification that the Russian apparatus or the UAE government are behind them with the certainty the report suggests. That does not invalidate the pattern —Mali does have a military junta and a surveillance legal framework that the text itself cites precisely—, but the attributions of authorship should be read with the same skepticism we apply to any cyberthreat attribution: "high confidence" is not the same as judicial proof.

What does hold up is the mechanics, and that is where the real news value of the case lies. The same pattern repeats across all three episodes: using a language model to automate tasks that previously required dozens of human analysts —drafting dossiers, generating coherent content in several languages, sustaining hundreds of fake personas without a crack— and hiding the state origin behind what looks like citizen noise. It is the same agentic orchestration capability we celebrate when it automates code or customer support, now applied to censorship, spying on dissidents and the manipulation of international forums. We already noted at Zendoric, in connection with other episodes of agentic AI in the service of espionage and fraud, that the immediate risk of this technology is not a distant superintelligence: it is the cheap industrialization of manipulation tasks that once required entire intelligence apparatuses. This report puts country names to that thesis.

There is also an asymmetry that is rarely discussed and that is laid bare here by a real case: Anthropic was able to detect and cut off these operations precisely because Claude is a closed model running on its own infrastructure, with the ability to observe anomalous usage patterns and revoke access. An open model downloaded and run on one's own server —the same open frontier that at Zendoric we consider a democratizing force, with GLM, Qwen or DeepSeek closing the gap with closed models— leaves no such trail. The governance advantage of closed models over open-weight ones, until now an almost theoretical argument, has a concrete use case here: nothing guarantees that the next operation of this kind will leave a trace if the operator chooses a model without telemetry.

That tension has no easy way out, but it does have an underlying reading. The transition toward an AI that eradicates disease and multiplies abundance only works if we build, in parallel, the governance infrastructure capable of distinguishing legitimate use from state abuse —something that today depends almost exclusively on companies like Anthropic choosing to publish what they find, with no external obligation forcing them to do so, or forcing others to match them. In the short term, the balance is uncomfortable: every new capability that brings the cure for a disease or nuclear fusion closer also brings an authoritarian regime closer to surveilling a dissident with less effort than ever. Closing that gap between capability and control, not slowing capability down, is the real task of this decade.