One consultant, one AI, 25 million SIM cards

The previous chapters were about money and espionage. This one is about people who are watched for what they think, what they believe or where they come from. Between January and July 2026, Anthropic identified and disrupted a series of operations in which state-aligned actors, state-linked contractors and commercial spyware vendors used its model to build or run surveillance systems. China, Iran, West Africa, the “surveillance for hire” market: from a lone individual to entire teams.

The chapter opens with three findings. They need to be read in order, because they describe a progression: first the tool, then the raw material, and finally the institution.

Three trends, and they reinforce each other #

1. AI is now used in place of an engineering workforce. A lone consultant, working for Mali's national security authorities, had a mass interception platform designed that could monitor communications across all the country's mobile operators and produce files on targets. The model was not used to analyse those files: it was used to write the software that made the collection possible. Elsewhere, Iranian actors had a malicious Firefox extension built and then deployed, which harvested users' identities on social networks. And a Chinese intelligence unit dealing with religious affairs, which once had several teams of analysts, was reduced to a single desk producing thousands of investigations a month.
2. AI is no longer only used to build tools: it ingests data in bulk to pick out targets. One actor uploaded batches of public posts and had structured profiles produced (location, demographic data, political leaning), each item of information given a confidence score. An Iranian unit had hundreds of thousands of posts analysed to select 39 opposition accounts to monitor. Chinese actors had content and press articles scored according to their political sensitivity, and people flagged to be placed under what they call “control”.
3. AI is becoming part of state security bureaucracies. A Chinese state security bureau had an internal manual on using AI in surveillance written, a sign that the model is entering daily work. In Iran, two units that shared neither code nor staff independently solved the same technical and usability problems on the same centralised case management system: AI is also used to overcome the bureaucratic bottlenecks of the surveillance apparatus.

Anthropic adds a sentence that closes the chapter before it has even begun: in almost every case, the targets are the same diaspora and dissident communities these regimes have targeted for decades: pro-democracy figures from Hong Kong, Tibetan and Falun Gong communities across Asia, Iranian minorities and opponents of the regime abroad. AI has not changed the targets. It has changed the cost.

Lakana 360: a whole country under interception, written by one person #

The case is referenced as GTG-50027. A single subscriber, probably an independent consultant based in Bamako working with Mali's state intelligence service, used Claude as the main engineering workforce to build a domestic surveillance platform at population scale. Product name: Lakana 360. Scope: around 25 million SIM cards, across the country's three national mobile operators. The report states that the actor designed the platform so as to get round Malian legal restrictions that require a court order for the disclosure of certain records.

• A layer collecting call records, messages and the voice itself through the core of the mobile network.
• A module that uses a language model to draft a narrative intelligence file on any phone number, without asking the service's user to show a valid legal procedure.
• A court warrant requirement removed from this module at the operator's request, reclassified as national processing with the check switched off by default and indefinite retention.
• Voiceprint tracking from one SIM card to another, which cancels out the basic protection of changing SIM cards.
• Flagging of users of encryption and VPNs, inference of clandestine meetings, geolocated watch lists, and matching against the national biometric civil register and other state registers.

The report groups these capabilities into four blocks, and the way they fit together is the real lesson. Targeted interception does have its own proper channel: warrant required, chain of custody, audit tools. But, Anthropic notes, these approval and audit rules do not extend to the mass collection layer. The control exists, it is documented, and it covers the least-used part of the system. It is a pattern also found in perfectly civilian systems: the procedure protects named access while the bulk export stays open.

The report notes that the US State Department and Human Rights Watch have documented detentions and disappearances of opponents, journalists and members of civil society by Mali's security services. And it adds the most important sentence in the chapter: the platform runs entirely on site, with local models. Anthropic banned the consultant's account. “Our account enforcement actions disrupted the actor's software and design activities, but not the deployment of the platform.”

One desk, four workstreams, thousands of files #

The chapter's second finding is bureaucratic in nature, and it may be more worrying than the first. Case GTG-14020 describes a single operator running what looks like a religious affairs intelligence post, with four workstreams running at once. The targets: Catholic cardinals in Asia, the leadership of the Presbyterian Church in Taiwan, members of Tibetan civil society and of the administration in exile, Falun Gong practitioners and their media, and Christian missionary networks linking Singapore, Hong Kong and mainland China. They ranged from high-profile religious leaders to private individuals.

The files recorded dates and places of birth, immigration dates, social media identifiers, and reconnaissance of places of worship: floor plans, façades, structural diagrams. Every document template required the same fields: China-related activities, scandals, and what the official vocabulary calls exploitable leverage over a person. In their instructions, the operators asked the model to adopt China's standpoint, to describe the Tibetan administration in exile as an “illegal separatist administration” and to apply to Falun Gong the state designation of “evil cult”. Coverage spanned Chinese and Western platforms alike, on a daily production cycle. One user stated during a session that they were responsible for information security for the Chinese state.

The internal manual, and the refusal overturned at the second attempt #

Case GTG-14021 brings together three operations linked to municipal public security and state security bodies, around the mission known as “stability maintenance”. Three levels of actor: a police officer, a police academic, an entire bureau.

• A municipal cyber police unit ran an opinion monitoring pipeline: automated extraction from a browser using custom skills, queries to a government surveillance database, and daily reports distributed to superiors. The system automatically tracked, across several platforms, the account of a well-known dissident living abroad.
• A detective turned police academy student asked for a weekly “stability maintenance” report. The model refused. The actor rephrased, and the refusal was overturned at the second attempt: he obtained operational instructions naming ten private citizens to be placed under “control”, divided into categories: interception of petitioners, coercive summons for a so-called “talk”, close surveillance of movements and communications.
• A local state security bureau produced daily “situational awareness” briefings in the format of government documents, then had this workflow written up as an AI user manual intended for circulation within the service, including the prompt formula that has the model play the role of an intelligence analyst serving the national security apparatus. The automated pipeline first harvested a list of civil society organisations before producing each report.

This third strand contains the most serious passage in the chapter: the bureau requested pre-operational intelligence on gatherings abroad: the assembly point, route and end point of a pro-democracy march in Vancouver, venues of Uyghur cultural events in Turkey, screenings at a freedom forum in Oslo. The reports produced described Uyghur advocacy as close to terrorism and major human rights organisations as hostile forces.

A related case, GTG-14022, shows the same logic applied to “public opinion monitoring”. A contractor working for government clients had a versioned working framework produced (the report cites a version 2.6, with a control table and annexes), feeding a daily pipeline that processed from 15 to more than 30 foreign press articles a day. The model scored each item according to its political sensitivity, replaced “government of Taiwan” with “Taiwan authorities”, put scare quotes around terms such as “human rights violations”, and went as far as recommending actions falling to specific ministries. Anthropic stresses that there is nothing technically new here. What is new is the model's place within the apparatus.

The report notes, and its candour deserves credit, that “our existing safeguards did not perform uniformly in these cases.” In one case, the model correctly refused and was then turned by a rephrasing. In another, it complied over many sessions without ever stopping. Anthropic says it is building these findings into its future protections and into the training of its models.

The other cases, in brief #

• A commercial intelligence vendor (the investigation points to an Israeli-Singaporean commercial intelligence company) had social media users from Iran and the Gulf classified in batches of around twenty-five posts, with location, demographic group and political leaning, each with a confidence score. The demographic classification had six groups: urban, clerical, military, youth, diaspora, rural. The final deliverables were written in formal Arabic, in the register of an official report, with sentiment scores broken down by Gulf nationality and recommended counter-narratives. In parallel, the actor was building up a stock of more than 255 fake accounts designed to pass as members of pro- and anti-regime populations. Anthropic spotted the operation at the pilot stage.
• Two linked Iranian units, sixteen accounts in total, used the model as an engineering department. An organisation with seven departments, present in several provinces, claimed to have a database of citizens' identities and to have profiled 6,388 Iranians in one year; it had 155,216 posts analysed to select 39 opposition accounts. The other unit put into production a Firefox extension disguised as a prayer times utility that harvested identities in bulk on the major platforms, plus a messaging de-anonymiser, a phone-number-to-identity resolver and a phishing page styled after the national identity service. Both fed the same central case management system, in which a person's record contained their national identifier, their beliefs, their criminal record, their social media accounts and an “action” tab. The model refused explicit requests for profiling and propaganda, but its protections did not refuse most of the requests for software tooling.
• An actor aligned with Chinese state security, who did not speak Arabic, ran a recruitment operation lasting several days in Syria: the model drafted the approaches in Syrian dialect, translated the replies in real time, played the role of an Arabic-speaking “expert” to check the quality of the manipulation (dialect, military terminology, the target's psychology) and formatted the result for reporting up the chain. Upstream, it turned chatter extracted from more than a hundred WhatsApp groups and dozens of Telegram channels into structured data, profiling people according to their vulnerabilities: financial difficulties, family separation, ideological disillusionment. The most valuable targets were those who still had family in Xinjiang: a lever that can only be pulled with the help of domestic security. The same actor also drafted tender documents and brochures for surveillance platforms aimed at government clients. The model refused several of the most serious requests, including clandestine interrogation.
• Other Iranian actors complete the picture: an automated open-source profiling harness targeting hundreds of people in Israel and in the Jewish diaspora; naval intelligence collection compiling targeting manuals from public information; a domestic platform combining automatic number plate recognition and interception of mobile device identifiers. One last actor ran sixteen single-operator organisations to develop phishing tooling: the model refused nine out of ten openly malicious requests, but its protections held up far less well once the work was split into small tasks spread over later sessions.

Why this concerns a French company #

An SME in Alsace is not targeted by a Malian intelligence service. Yet four consequences concern it directly.

1. The value of your files has changed scale. What used to cost a team of analysts now costs a session. A customer file, an HR directory, a CRM export, a database of job applications: the cost of exploiting them for profiling has collapsed. Minimisation (collecting only what is useful, keeping it only as long as necessary) stops being a GDPR formality and becomes the only measure that genuinely reduces the harm if there is a leak. Purging is protecting.
2. Your telecoms and geolocation data is sensitive. The Lakana 360 case is a reminder of what metadata contains: who talks to whom, when, from where. If you run a geolocated vehicle fleet, badge access control, IP telephony or CCTV, you hold the same raw material. Short retention period, named and logged access, a written purpose.
3. Transnational repression exists, and it affects ordinary people. If you employ, host or support people from the countries concerned (students, researchers, staff on secondment, refugees), the information you hold about them may have a value you cannot imagine. Do not publish a detailed staff directory with photos, do not circulate named assignments, and do not answer any request for information about a person without a verified legal basis. The pre-operational intelligence in case GTG-14021 (route, assembly point, times) is made up of exactly the kind of information an organisation publishes without thinking.
4. Controls must apply where the volumes go. The lesson of Lakana 360's four blocks applies to any information system: an impeccable authorisation procedure for viewing individual records is useless if the bulk export escapes the same regime. Look at where your bulk extractions happen (the monthly spreadsheet sent to the accountant, a database export to a contractor, replication to a test environment) and apply to them the rule for individual access.

Tomorrow: the industrialisation of fakes. Fake journalists, fake activists, fake lovers, and what is left as proof when images, voices and video no longer prove anything.

Sources #

• Anthropic, Detecting and countering misuse of AI: September 2026 (10 September 2026): Surveillance operations chapter, pages 81 to 110.
• Cases cited: GTG-50027 (Mali), GTG-14010 (Uyghurs in Syria), GTG-14020 (religious affairs), GTG-14021 (“stability maintenance”), GTG-14022 (“public opinion”), GTG-34007 (Iranian units), GTG-54009 (commercial vendor), GTG-30004, GTG-30005 and GTG-30006.
• Our article on self-hosting models: self-hosting an LLM for business applications.
• For compliance, our practical reading of the self-audit of ANSSI's 42 measures.