A new security report from Anthropic describes how actors with alleged links to government bodies may have used Claude for surveillance work. Published on September 10, the report covers cases the company says it disrupted between December 2025 and August 2026. What is troubling is less a vision of all-powerful AI than the sober acceleration of familiar work: sorting data, summarizing reports, prioritizing profiles, and turning suspicions into the daily routine of an agency.
That distinction matters. Surveillance does not begin with a new model. It requires data sources, legal or de facto power, staff, and a lack of oversight. AI can, however, reduce the cost and time of individual steps. Work that once occupied several analysts can then be incorporated more easily into larger routine processes. That is why the report matters even to people who will never use Claude themselves.
Key takeaways
- Anthropic reports disrupted misuse cases across seven harm areas, including surveillance and cyber operations.
- For surveillance, the report and independent coverage point mainly to analysis, prioritization, and the automation of daily routines.
- The core problem is not magical model capabilities, but data access, permissions, and a lack of accountability.
- For providers, public authorities, and companies, the lesson is that safeguards must address model access, tools, and the review of decisions.
What Anthropic actually documents
Anthropic’s threat-intelligence report is not an overview of ordinary Claude use. The company itself stresses that it presents particularly notable and novel cases. It names seven areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and model distillation. The examples are therefore not a measure of how most users work. They do show which forms of misuse a provider can detect in its logs as models and tools become more capable.
For surveillance, Anthropic describes actors linked to government bodies in Mali, China, and Iran, among other cases. According to Axios reporting, Claude models were allegedly used to analyze social-media data, assess political sensitivity, prioritize possible targets, and prepare recurring intelligence reports. Anthropic says it banned the accounts involved and strengthened safeguards afterward.
The specific attribution should be read with care. The report comes from the provider itself, and the public cannot inspect all raw data. That is precisely why it makes sense to distinguish among observed evidence, technical interpretation, and political conclusions. Even so, the kind of work described supports a straightforward finding: for a system of control, it is already useful if software can presort large amounts of existing information more quickly. It does not need a perfect algorithm for that to become a serious civil-liberties risk.
The dangerous efficiency is in routine work
AI surveillance is often discussed as if a system could automatically see through people. The more realistic mechanism is more ordinary and, for that reason, harder to notice. A model can summarize text, extract names and places from large data sets, flag recurring patterns, or put a report into a required format. Each function looks mundane on its own. Together, they can greatly expand an institution’s reach.
The problem begins when an automatically generated signal is treated as an objective judgment. Language models can write plausibly without being reliably correct. They can misunderstand irony, ambiguity, or regional language. If such an error remains in an internal note, it is frustrating. If it determines who is monitored more closely, questioned, or excluded from a service, it becomes consequential. People captured by a system often do not even learn which data or assessments contributed to their profile.
The recent article about Meta’s agent Muse covered a much more ordinary application. Yet it demonstrates the same principle: once a system moves from information to action, responsibility and consent must be visible. In state surveillance, the threshold is higher still because affected people cannot freely give consent and power imbalances are already part of the case.
Why model limits alone are not enough
Providers can make misuse harder: verify accounts, detect suspicious patterns, refuse harmful requests, and suspend access. That is necessary. It does not settle every question. A model does not need to receive secret data to be used for surveillance work. Processing publicly collected posts, existing files, or information from other systems can already have sensitive consequences. Users can also break tasks into small steps that appear harmless at first.
That is why looking at the full chain matters more than focusing on one safety filter. Who supplies the data? Who may combine it? Which tool can access which database? Who sees it when the system classifies a person incorrectly? And which body can correct a decision? The lesson of the fourth Claude test incident applies here as well: a technical limit is valuable, but it cannot replace independent scrutiny of incentives and the entire environment.
For companies using AI internally, this is a practical warning. Even a well-intended tool for fraud prevention, workforce planning, or customer support can turn into a hidden scoring machine if it pulls together too much data and produces results that cannot be reviewed. Systems that prioritize people, restrict access, or make recommendations to people with decision-making power are especially sensitive.
Transparency is not just a report after the fact
Anthropic publishing its cases is useful because it makes clear that safety work does not end with general policies. At the same time, a company disclosure is no substitute for external oversight. Providers decide which cases they recognize, how they describe them, and which data they can publish. Independent research, data-protection authorities, courts, and a critical public therefore need their own ways to examine risks.
In Europe, the EU AI Act offers a framework for especially high-risk AI uses, but rules help only when they become concrete in procurement, operations, and oversight. A public authority or company should not wait for a scandal to ask whether a tool has been preparing sensitive decisions. It needs documented purposes, minimal data access, logs, regular error testing, and a way for affected people to challenge decisions. Treating that work as bureaucracy confuses speed with legitimacy.
Outlook: The warning is organizational
Anthropic’s report does not provide a simple number for the overall scale of AI misuse. It does show a pattern: language models can turn many small work steps into scalable infrastructure. The particular risk is not that a machine suddenly replaces a state. It is that it can help existing power operate faster, more cheaply, and less visibly.
The appropriate response is therefore neither technology panic nor a blind reference to one safety filter. Providers must detect misuse and limit access. Organizations must control the data, permissions, and consequences of their tools. And where people are monitored or evaluated, there must be understandable rules and real avenues for appeal. Only then can it be decided whether automated assistance serves a legitimate purpose—or merely makes an old system of control more efficient.