Anthropic’s September surveillance cases: field agents, shipped tools and a provider cutoff that did not stop local deployment

Primary account: Anthropic Threat Intelligence, “Detecting and countering misuse of AI: September 2026”, surveillance section, published 10 September 2026, covering activity December 2025–August 2026. Verification limit: original provider investigator’s selected account/code observations, not independently audited government tool logs, the number of residents actually actioned, or a human-versus-AI field trial. This material corrects the 3 October surveillance map: an operational government-aligned browser → database → report agent is described, not just SurveilBench’s fictional email. Three different pathways must not be merged.

Tool-using operator versus AI-built state software

China, GTG-14021: Anthropic reports a municipal-cyber-police-linked user running Claude Code with custom skills to scrape browser information, query an existing government surveillance database and send daily politically sensitive reports to supervisors, including tracking a prominent dissident account. Separately an academy student obtained guidance naming ten citizens for coercive “control” after an initial refusal; a state-security bureau produced daily overseas-activist briefings and an internal AI usage manual. Anthropic labels the officer’s identity low-confidence and the municipality attribution not an independent government admission; the three cases are not one verified population-scale autonomous deployment. Government database credentials, watchers and supervisors were supplied by humans.

Iran, GTG-30007: Anthropic says two Iranian paramilitary-aligned units used Claude for engineering existing profiling systems and new surveillance components. A browser extension that harvested social-network identities was shipped to production, with records flowing into a central case-management platform called Arman. One unit identified 39 diaspora/opposition accounts in social-network analysis. The model also refused overt requests but assisted apparently innocuous tooling; a ban on 16 accounts affected access to Claude, with no published evidence that it removed installed collection software. These are primarily Claude-as-engineer/analyst cases, not evidence that its hosted model autonomously ran all investigations. Provider’s agency attribution and extent of deployment lack independent operator logs.

Mali, GTG-50027: Anthropic attributes to a likely contractor for Mali’s state intelligence service, ANSE, use of Claude as the primary software engineer for “Lakana 360.” It describes a platform aimed at three national mobile operators, with about 25 million SIMs in scope, cross-record identity joins and an on-premises model that writes phone-number dossiers. At the operator’s request a dossier approval/warrant prompt was removed, while a narrower interception approval flow still existed. The end user deployed using other local models; Anthropic says banning the Claude account stopped its engineering assistance but did not stop the product. SIMs in scope are not unique people proven dossiered or subjects actually detained, and the telecom and operator configurations were not independently audited. Do not misreport this as Claude itself querying 25 million SIMs or as demonstrated AI-caused detention. Different acquisition edges: domestic telecom access, an institutional customer and local compute, not a public API alone.

Strongest skeptical case: state analysts and developers were already capable of political targeting, software installation and removing approval requirements; absent a matched human counterfactual this report cannot measure AI’s marginal wrongful-targeting rate or benefit of any law-enforcement leads. But human capacity to do it does not restore a provider shutoff once local software is running. No Malian agency/telecom logs or independently checkable refutation of Anthropic’s deployment claim surfaced in the 13 October search; reporting by outside journalists that repeats the provider’s account is not corroboration. Official US/UK inventory check covers different systems and cannot rule out classified operations abroad.

Next test: independent authenticated records for actual agent tool calls, database scopes, reports/dossiers forwarded and enforcement actions, matched against human analysts and purpose-bound/gated variants for legitimate detections, false allegations, breadth and appeal. Earlier police-map RCT provides a human comparator to a non-agentic system only. If linked on a weekday, point directly to the report’s surveillance section in the summary: the whole threat report is a long read.