Imagine scrolling through social media and pausing at a post from @BanglaExpatSharjah. The account appears to belong to a Bangladeshi worker living in Sharjah, one of the emirates of the United Arab Emirates. It might share everyday observations, complain about the weather, or comment on the challenges faced by migrant laborers in the Gulf. To the casual eye, it seems human. It has a name, a location, a persona. But according to a threat intelligence report released by Anthropic in September, that account was not what it appeared to be. The handle formed part of a collection of synthetic personas tied to an AI-assisted surveillance operation targeting Iran and the Gulf region. Anthropic, the company behind the Claude language model, said the activity was carried out by, or on behalf of, S2T Unlocking Cyberspace, an Israeli-Singaporean commercial intelligence vendor identified through open-source research. Claude’s involvement was discovered during an internal review, and Anthropic banned the account in June 2026. The findings were made public in the company’s September threat intelligence report, published on September 10. Reuters followed up the next day, noting that S2T had not immediately responded to a request for comment. What makes this story unnerving is not just the fact that a company tried to build a fake online identity. It is that the tools used to do so are the same ones now widely available to the public. Large language models like Claude can generate coherent text in dozens of languages, imitate different writing styles, and even mimic the small idiosyncrasies that make a social media account feel authentic. When those capabilities are combined with a systematic surveillance agenda, the line between real and fabricated begins to blur. The episode is a chilling reminder that in an age of generative AI, a convincing online identity can be manufactured at scale—and that the tools we use to connect with others can be quietly repurposed as instruments of monitoring and manipulation.
The Bangladeshi-themed handle did not exist in isolation. It appeared in a category labeled “UAE expatriate” alongside a cluster of similar accounts: @PakistaniDubaiWorker, @AjmanLaborForum, and @IntlCityWorkers. Together they formed a small universe of synthetic identities designed to look like migrant workers and labor activists in the Emirates. The names are carefully chosen: they sound like grassroots organizers, community pages, or ordinary individuals, not like official intelligence assets. That is precisely the point. If someone in a Facebook group for South Asian workers receives a friend request from @PakistaniDubaiWorker, they might be more inclined to accept it than a request from a stranger with no history. Anthropic was careful, however, to describe these handles as part of a synthetic training dataset—caught early in the company’s review process—and said they were not assessed to have been used operationally. In other words, the findings do not establish that @BanglaExpatSharjah ever posted in a Bangladeshi community group, followed real migrant workers, or took part in conversations about labor rights. This distinction matters. It is easy to imagine the worst-case scenario: a fake persona quietly infiltrating a Facebook group where workers share advice about unpaid wages, or a Twitter account pretending to be a labor organizer while feeding information to commercial intelligence analysts. But Anthropic’s report suggests the operation was still in a preparatory phase when it was discovered. That is both a relief and a warning. A relief because no direct harm has been documented; a warning because the very creation of such personas reveals an intent to deceive. Migrant workers are especially vulnerable to this kind of manipulation. They are often far from home, dependent on employers, and unsure where to turn for help. A digital community can be a lifeline—but only if it is real. The infrastructure for large-scale online impersonation is already here, and it is being tested.
Anthropic’s investigation found that the operation used Claude for two connected tasks. The first was user profiling. The second was content generation for fabricated online personas. Investigators identified a workstream involving more than 255 synthetic social media accounts, which they interpreted as preparations for future deployment. The profiling system worked in batches, processing around 25 social media posts at a time and asking Claude to infer each poster’s demographic group, location, and political leanings. The model attached confidence ratings to its assessments, effectively ranking how certain it was that a given user was, say, a rural laborer or an urban professional. Users were sorted into six broad categories: urban, clerical, military, youth, diaspora, and rural. The system also classified people as government supporters or opponents. This is not just passive listening. It is the careful mapping of human beings into boxes that make them easier to understand, predict, and eventually target. The outputs of this process were equally troubling. Anthropic described formal Arabic-language intelligence briefings styled to resemble government communications. These briefings contained sentiment scores broken down by Gulf nationality and suggested messages to counter the views being analyzed. In plain language, the AI was being used to produce sophisticated psyops materials: not only understanding what people were saying, but also proposing narratives to shift their opinions. Anthropic assessed that the systems were likely intended for Arabic-speaking customers in the Gulf, but its investigation did not identify a government buyer or confirm that a government had commissioned the work. That unanswered question hangs over the entire report. It is possible that S2T was building the capability on spec, hoping to sell it to a willing client, or that the buyer remains hidden. Either way, the scale of the operation—255 accounts, automated sentiment analysis, and targeted counter-messaging—suggests something far more ambitious than ordinary intelligence gathering.
Beyond the UAE expatriate category, the synthetic identities included personas resembling Iranian diaspora communities, student protesters, military figures, and clerical accounts. Anthropic said the content-generation activity suggested an effort to create identities that could pass as members of both pro-government and anti-government Iranian communities. This is a particularly insidious feature of the operation. In politically charged environments, people are often suspicious of strangers who ask too many questions. A successful intelligence operation needs aliases that fit seamlessly into the local digital ecology. An account claiming to be an Iranian student abroad might use particular slang, discuss a specific university, and express the right amount of anger at the regime. An account pretending to be a military supporter might share patriotic content and mock exiled dissidents. By generating personas across the ideological spectrum, the operators could potentially insert themselves into both sides of the conversation. They could monitor opposition activists while also tracking loyalist networks. They could sow confusion by creating fake accounts that say extreme things in the name of one faction, then use another fake persona to condemn that faction. Anthropic did not say these particular personas were deployed, but the design logic is unmistakable: to understand a divided society, you need to be able to blend into every part of it. The ability to manufacture trust with AI-generated text is what makes this so dangerous. People tend to believe that an account with a history of thoughtful posts is real. But that history can now be generated synthetically, in large volumes, with different personalities, political views, and cultural references. What used to require hours of human curation can now be automated. For Iranian dissidents, the threat is not just that a foreign intelligence service might be watching. It is that they might be talking to a fictional ally, sharing their hopes and fears with an algorithm designed to profile them.
S2T’s surveillance capabilities were not unfamiliar to investigators. In February 2023, the journalism collective Forbidden Stories published an investigation tracing a confidential brochure found in leaked Colombian military files to the company. The document advertised capabilities that went far beyond collecting publicly available information. It included fake accounts, phishing, and tools for installing malware remotely. According to Anthropic, the brochure described methods such as infiltrating private WhatsApp and Telegram groups, collecting membership lists, and subsequently using phishing or device compromise to gain deeper access. Anthropic said its own findings corroborated that earlier investigation. It also noted that AI-generated persona content could provide a “credibility layer” to make fabricated accounts more convincing. This is a key insight. A phishing email is much more likely to succeed if it appears to come from a known contact with a believable history. A fake WhatsApp message from a “fellow worker” is more dangerous if that worker has been posting in the group for weeks. Traditional reconnaissance could gather the raw material for such impersonation, but AI makes it possible to sustain the illusion at scale. Yet Anthropic was careful to distinguish between what S2T advertised and what it directly observed. The company said it identified the operation at the pilot stage and found no evidence that the later surveillance stages—the infiltration, the phishing, the malware—had been carried out against real targets before the Claude account was banned. That is an important caveat. It means the worst-case scenarios remain hypothetical, at least as far as Anthropic’s investigation could determine. But it would be wrong to take too much comfort from that distinction. A pilot stage is, by definition, a precursor to something larger.
The action taken by Anthropic was swift insofar as it could be. The company said the activity breached its rules against surveillance, political profiling, and the coordinated use of deceptive accounts. It also shared technical indicators with partners who track commercial surveillance vendors, allowing other platforms to look for similar patterns. Its immediate intervention blocked the operator’s access through that particular Claude account. But the report did not establish that the wider surveillance project had ceased. That is perhaps the most unsettling part of the story. Banning one account is like closing a single door in a building with many exits. The people behind S2T could, in principle, open another account, use a different AI service, or adapt their methods to avoid detection. Anthropic’s report is a valuable piece of transparency, but it highlights the limits of any single company’s ability to police the use of its technology. The problem is not just one vendor or one tool. It is the growing availability of generative AI to actors who want to manipulate public opinion, profile dissidents, or infiltrate vulnerable communities. For a migrant worker in the Gulf, the threat is not simply that a secret report contains their name. It is that the digital spaces where they seek support and solidarity may be seeded with fabricated friends. For an Iranian student abroad, it is the knowledge that a “fellow protester” might be a commercial surveillance product. These are not abstract concerns. They are the human costs of an industry that treats online identity as just another commodity. The story of @BanglaExpatSharjah is a story about the future of trust. In that future, the face behind a profile may be the most sophisticated thing about the account—and the one thing that is not real. Anthropic’s report does not solve this problem. But it gives us a rare glimpse behind the curtain, and it reminds us that the fight to keep the internet human is far from over.