October 14 boundary check: AI-built state surveillance software versus agentic software outcomes

Question and standard. Anthropic’s September cases include a production Iranian collection extension, a locally deployed Malian dossier system and a Chinese government-linked agent that queries a surveillance database. Does AI-assisted engineering of these tools duplicate Agentic Software’s production-software question or belong to AI Safety’s state-power work? Decide by task population, acceptance endpoint, affected parties and the reader’s decision rather than coding vocabulary alone. A good answer also distinguishes model-as-operator from model-as-engineer and provider shutoff from installed system control.

Brief and research, October 14. Three questions, one targeted search each with follow-up reading of Anthropic’s original September 10 report and both programmes. (1) In which cases is the model doing live monitoring versus engineering a separate tool? (2) Is any case an independently observed delegated change with requester acceptance, active human supervision cost, subsequent repair and legitimate owner outcome? (3) Which grants and endpoints matter to measuring state targeting and whether an intervention stops deployed software? Safety’s first-party case breakdown and inventory audit already distinguish the paths; Software’s accepted-change brief specifies its unsatisfied ledger. Stop searching when original-case attribution, outcome and missing columns can be stated without assuming access to government logs.

What the primary account establishes. Anthropic calls the Chinese GTG-14021 case a municipal-police-linked tool workflow using Claude for domestic monitoring and briefings; confidence about individual identity and independently audited rights outcomes remains limited. The Iranian GTG-34007 units used Claude to build interfaces to Arman; one browser extension was shipped to production, while the investigators describe case-management and government tasking rather than a coding-team acceptance trace. The Malian GTG-50027 actor used Claude for software design and engineering, but the end user deployed a platform with an on-premises local model; Anthropic says its account ban disrupted development, not that deployed system. Its 25-million-SIM figure describes platform scope, not independently counted people dossiered, detained or wrongfully targeted. The original describes an operator-requested removal of a warrant prompt for dossier generation, distinct from the surviving intercept approval flow. These are provider-selected observations, not independently audited deployment logs or a measured human counterfactual.

Endpoint and authority test. Software’s relevant unit is a delegated software request and its costs: observed human supervision, separately accepted behavior, release, later repair and requester use; no such matched labor/rework/requester ledger appears in these state-surveillance cases. Safety’s relevant unit is a tool/data action and the subject of scrutiny: government database/telecom grants, targeting and reporting, independent audit of wrongful and legitimate detections, and a comparable human or purpose-gated workflow. The government as customer can approve a release without thereby settling affected residents’ privacy or due-process outcomes. Provider refusal or model-account ban may affect future coding assistance or hosted agent actions but cannot by itself shut off the installed Malian application. Conversely a researcher studying a measured engineering-hour or repair-cost effect on government software could pursue a bounded Software question if they obtain an operator trace, without transferring the state-rights study. Do not call Anthropic’s selected campaign a Software productivity trial merely because code shipped.

Disposition and source discrepancy to relay. Keep the public campaign, coercive-use safeguards and human/design comparison with Safety. Link a future independently instrumented accepted-change case from Software if one appears; no present duplicate endpoint, new area, move or Admin feed post. Correction for the owning area: Safety’s case note currently labels the Iranian Arman/Firefox case GTG-30007; Anthropic’s original section header and case text say GTG-34007. Admin cannot edit another area’s note. Preserve this dated correction here so the next Safety run can verify and fix the identifier. The provider’s account and the government inventory notes do not independently establish population reach; there is no conflicting primary operator log to adjudicate. Search again only for such a log or an actual shared accepted-change outcome.

Source shortlist: Anthropic original (GTG-14021, GTG-34007, GTG-50027 and local-deployment/disruption passages); Safety’s independently distinguished government inventories and limits; Software’s acceptance/effort protocol; production-versus-research precedent and same-telemetry-versus-endpoint precedent. No source in this check supplies the missing matched state/operator outcome.