It’s easy to think of artificial intelligence misuse as little more than a smarter phishing email or a slightly more convincing fake profile. But a new report from Anthropic, the AI company behind Claude, paints a far more unsettling picture of where this technology is already being used. Published on September 10, the report documents malicious activity detected between December 2025 and August 2026 across cyber operations, influence campaigns, surveillance, scams, conventional weapons, and even biological research. The cases involve Anthropic’s Claude Haiku, Sonnet, and Opus models, but the real story is not about any single technical breakthrough. It’s about how AI is quietly changing the economics of harm. Tasks that once required teams of writers, analysts, programmers,and operators can now be split between machines anda shrinking number of humans. The humans who remain no longer have to grind through thousands of repetitive actions; instead, they set objectives, make high-level decisions, and review what the AI produces. That shift means a handful of people can now run operations that previously would have required a small army. It’s not that AI has become some kind of evil genius; it’s more that it has become an incredibly cheap, tireless, and scalable worker, willing to crank out content, classify strangers,and hold endless conversations without ever sleeping, complaining, or asking for a raise.
Perhaps the clearest example of this new AI-powered production line isa influence-for-hire operation that Anthropic traced to LKM Company, a France-based digital advertising agency. The operation built approximately seventy fabricated news websites, each carefully styled to look like an independent local publication.These sites were linked to around seventy matching X accounts and more than two hundred fifty additional inauthentic commenting accounts, creatinga illusion of organic communities across six continents. Anthropic found at least 8,913 articles published in around twenty languages, though most generated little real-world engagement—the campaign basically shouted into its own echo chamber, classified by Anthropic as Category Two on its Breakout Scale because its content never substantially escaped its own network. What makes this case so striking is not the quantity of fake news, but how seamlessly Claude was incorporated into the publishing infrastructure. The operators’ prompts demanded fixed JSON structures, formatted HTML, exact character limits,and three to four internal links per article, so that the output could be generated ina predictable, machine-readable format and automatically uploaded into the publishing system. The same underlying story could be rewritten for different ideological audiences, stripped of its original context, moved across borders,and given a fake journalist byline to suggest separate editorial teams. Powerful as that sounds, the human operators still had to decide the overarching objective, the narratives, and which audiences to target. But the brute labor of generating articles, localizing them, formatting them,and preparing them for publication was almost entirely automated. One revealing example involved the Democratic Republic of Congo, where the network produced 318 articles largely supporting the government’s position on regional mineral deals and tensions with Rwanda. In other words, AI didn’t just spam nonsense; it helped run a coordinated, politically targeted propaganda campaign with only a tiny human footprint.
The same capability that creates fake news can also be turned inward, transforming public social media into a kind of mass surveillance system. Anthropic identified a commercial surveillance operation that used Claude to analyze social media activity from users in Iran and the Persian Gulf. The system mapped users’ locations, classified them into demographic groups,and produced Arabic-language intelligence briefings in the style of official government reports. Anthropic linked this activity to an entity called S2T Unlocking Cyberspace, which open-source research identifies as an Israeli-Singaporean commercial intelligence vendor. In one workflow, operators fed Claude batches of roughly twenty-five social media posts ata time, instructing the model to determine each poster’s demographic group, location,and political leanings,and to assign confidence ratings to those assessments. What used to require a trained analyst reading every post individually now becomes something closer to a structured database of human profiles, generated ,continuously, and quietly. Anthropic found other examples of the same pattern. An Iranian unit used Claude to process hundreds of thousands of social media posts and select thirty-nine opposition accounts for closer monitoring. In China, operators used Claude to score social media and news content for political sensitivity,and identify individuals for what they described as “control.” Another China-aligned operation went even further, using Claude to support an attempted recruitment campaign targeting Uyghurs in Syria: the model drafted outreach messages in the appropriate regional dialect, translated replies in real time,and even assessed the quality of the operation itself. None of this requires any dramatic new breakthrough in AI capability; it just requires an willingness to point existing tools at ordinary people’s posts and let the model do the reading, sorting, judging,and reporting. The human cost is harder to see from outside, but it’s real: people’s casual online expression can now be harvested, categorized,and weaponized against them without any human analyst ever needing to read their words.
Nowhere is the human dimension more visceral than in the world of online romance. Anthropic uncovered a China-based app studio that operated more than twenty dating apps while secretly presentingautomated AI personas as real people. Over two weeks in April 2026, more than 4,700 AI personas interacted with at least25,000 people, and Claude generated about2.36 million messages during that period alone. To keep up the illusion, the operation divided the work remarkably efficiently: rough three AI personas for every real person recruited as a gig worker. The AI handled continuous, tireless conversations, while human workers stepped in for tasks that were harder to automate—live video calls, social media follow-backs,and probably anything requiring real human presence. Another AI model generated reply suggestions for those human workers, helping them respond quickly and consistently with the persona’s established personality. According to the report, the app’s feed was roughly75 per cent Claude personas and25 per cent real people. The AI personas were explicitly instructed never to reveal that they were automated,and to steer conversations through predefined stages, presumably leading toward financial scams. Backend systems even generated fake engagement signals when necessary, making the AI personas appear popular, desirable,and real. This represents a fundamental change in the business model of online fraud. Previously, romance scams required hundreds or thousands of real humans, each maintaining individual relationships with victims over weeks or months—an expensive, labor-intensive operation. Now, humans become a verification layer, stepping in only when a real-world interaction is required. The emotional damage to victims remains exactly the same: real hearts are broken, real bank accounts are drained, andreal trust is betrayed. But the machinery behind the deception has become vastly cheaper,and therefore vastly more scalable, meaning more people can befooled by fewer perpetrators with far less effort. It’s a chilling reminder that automation doesn’t just affect factories; it affects the most intimate corners of human connection
The most difficult category in Anthropic’s report is biological research, because here the same scientific knowledge can be used for healing or for harm—and it’s nearly impossible to tells whichis which. Anthropic describes five case studies involving research connected to pathogens, toxins,and other biological capabilities. The company deliberately withheld the names of the institutions, countries,and specific agents or techniques involved, and it explicitly says it does not assert that the researchers intended harm. One case involved a researcher using Claude to builda database of venom peptides and then develop a system for optimizing their characteristics—stated goals included therapeutic applications, but the underlying work could also be used to generate harmful compounds. Another researcher used Claude in computational work involving toxins while deliberately keeping the identities of some biological agents vague in progress reports, perhaps to avoid scrutiny. Anthropic’s conclusion is measured: these cases are not evidence that Claude has already enabled an imminent biological catastrophe. But they do show how increasingly capable AI systems are becoming useful tools for sophisticated dual-use research, including work associated with state actors. The danger here is not a rogue AI suddenly inventing a bioweapon in a lab. It is that AI lowers the barrier to advanced scientific work, allowing smaller groups—including those with harmful intentions—to explore areas of biology that were previously accessible only to well-funded, well-trained institutions. The same reasoning that makes AI useful for legitimate drug discovery makes it useful for toxin optimization; the technology does not care about intent. Anthropic’s report therefore does not call for a halt on biological AI applications; instead, it quietly emphasizes how difficult it is to draw a clean line between beneficial and harmful uses of the same model capable.
Underlying all these cases is a broader shift, one that Anthropic describes as AI moving from being an assistant to becoming an orchestrator. In cyber operations especially, AI agents performed reconnaissance, data processing, exploitation,and other steps, with humans merely setting objectives and reviewing results. In one Russian espionage case, AI-assisted workflows handled infrastructure acquisition, phishing, persistence,and data theft. The system could even detect when malware had been caught by security products, modify it,and rebuild it to evade detection. In other words, AI wasn’t just helping a hacker write code; it was running chunks of the entire hacking campaign, adaptively responding to obstacles and adjusting its approach. The same pattern appears across influence operations, surveillance,and fraud: as humans focus more on deciding what they want done, AI systems handle larger and larger portions of how it actually gets done. This changes the strategic balance of malicious activity. Previously, the scale of a disinformation campaign, a surveillance program, or a fraud operation was largely limited by headcount: you needed enough people to write articles, read social media posts, or chat with victims. Now, that constraint is eroding. Access to capable AI is becoming more important than the size of the organization using it. A small, motivated group with access to Claude-class models can potentially operate on a scale that previously would have required a state intelligence agency or a massive criminal enterprise. That doesn’t mean AI is omniscient or omnipotent; operations still make mistakes, get caught,and often fail to break out into real-world impact. But the trend is unmistakable: human labor is being replaced by algorithmic labor, and the bottlenecks to harm are shifting from people to computation.
These findings inevitably connect to a much larger and more contentious debate about where AI development is heading. The report itself deliberately avoids apocalyptic claims: it does not say that current misuse cases demonstrate an approaching extinction event, and it is careful to note that trouble lange. But just a day before it report was released, former Anthropic researcher Jacob Coxon resigned and publicly warned that companies developing advanced AI were “racing straight to self-improving superintelligence,” and that researchers building the technology believe it could kill humanity by the end of the decade. Responding to Coxon’s post, Evan Hubinger, alignment science lead at Anthropic, said in a post on X that he also personally estimated the probability of AI killing all humans at more than10 per cent over the next decade—while acknowledging that Anthropic does not yet have a plan to solve alignment for superintelligence. That warning concerns a far more extreme future scenario than the documented misuse cases in the report, but they are not unrelated. If AI is already capable of running fake newsrooms, turning social media into surveillance databases, automating romance scams at massive scale,and assisting with dual-use biology research, it is reasonable to ask what happens as these systems become more powerful, more autonomous,and more integrated into critical infrastructure. The report’s evidence shows something immediate and tangible: AI is already reducing the amount of human labor required to operate sophisticated deception, surveillance, fraud,and cyber campaigns. The humans behind these operations are increasingly becoming directors rather than workers, andthe scale of misuse is becoming dependent on access to capable AI rather than the size of the organization using it. That is not a distant sci-fi prophecy; it is a present-day reality. It demands public attention, thoughtful regulation,and a honest conversation about how much power we are willing to hand over to systems that are still, inmany ways, learning how to navigate human trust.