Manufacturing fake humans at scale

Two chapters of the report, influence and scams, tell the same story in two different guises: manufacturing humans who do not exist, in large numbers, and having them talk to humans who do. Nine influence operations from Russia, Iran, Turkey, the Gulf, South Asia, Africa and Europe, a network of dating apps, and one common thread: proof by face, voice and writing style no longer proves anything.

What Anthropic sees and the platforms do not #

The vantage point is unusual. A social network discovers an operation once the content is already circulating. A model provider sees it while it is being built: when the actor plans, chooses targets and writes material. Hence an ability to intervene early, and complete blindness as to what happens next. To measure impact, Anthropic uses the Breakout scale, with six categories: the first describes content confined to a single community on a single platform, the following ones increasingly wide circulation.

The chapter opens with eight trends, which read like the job description of an industry in the process of professionalising.

• Influence sold as a service. Companies produce content for whoever pays, which gives the client plausible deniability. In two cases, a working advertising or marketing agency ran the operation alongside its ordinary work.
• AI as an editorial desk. The model slots into an existing human editorial chain, allowing poorly resourced actors to operate at a scale beyond their reach.
• AI builds the apparatus, not just the content. Doctrine manuals, files on the opposition, ministerial portfolios, persona systems, target databases, employment contracts encoding editorial loyalty, staff scoring grids.
• Persistent tooling. Doctrine files reused almost word for word across hundreds of sessions, lists of banned words in the agents, shared files of approved sources and evasion rules, software calling the model in fixed batches. The producers no longer need to know one another. One actor was putting together a course to teach the method.
• Laundering of attribution, source and certainty. Removing state attribution from republished material, passing claims through chains of outlets until they seem independently confirmed. In one Russian case, the actor produced claims the model described as unverified, then ordered it to remove those caveats.
• Tighter operational security. Erasing the marks of machine-generated text, building account warm-up logic, stripping metadata and code names before delivery. On the access side: VPNs, foreign numbers, account rotation, third-party services masking the origin.
• Fake personas and impersonation of real people. Generated profile photos, invented biographies for fake journalists, but also impersonation of real people and institutions, including a state spokesperson and a human rights organisation.
• Targeting of people and of accountability mechanisms. Cloning a real activist's account, testimony written by a third party and delivered before an international body, counter-files on UN rapporteurs.

Seventy newspapers that do not exist, run from France #

Case GTG-54002 is the one that should most catch a French reader's attention. Anthropic traced to LKM Company, a French online advertising agency, a network of around seventy fake news sites presenting themselves as independent local newsrooms, amplified by as many accounts on X and by more than 250 commenting accounts created in June and July 2025, many with generated profile photos. The domains were registered from France in ten weeks, on shared infrastructure behind a single deployment: it was this hosting detail that linked them to a single account.

• 8,913 articles in some twenty languages, aimed at six continents, with a concentration on the United States, Brazil, France and the Democratic Republic of the Congo, including 318 articles for the latter.
• A standardised pipeline: each prompt required a fixed JSON structure, formatted HTML, exact character limits and three to four internal links per article, explicitly to improve the sites' ranking in search engines.
• Three recurring manoeuvres: rewriting the same news story in two opposing ideological directions depending on the audience, adding a political angle to a subject that had none, and laundering a story by moving it across borders until it lost its context.
• Bylines of journalists who do not exist, to give each site the appearance of a newsroom.
• The network defended no particular line: it switched sides depending on who was paying. That is the definition of influence sold as a service.

What gave the network away: on 11 September 2025, its sites published almost identical articles on the conflict in the DRC three minutes apart. Anthropic rates the operation category two, with no breakout beyond its own accounts.

A thousand warmed-up accounts for one election #

Case GTG-84005 documents a commercial election manipulation platform targeting Malaysia, linked to an Istanbul technology company that sold access to it. Its internal documentation presented it as a real-time, military-grade, AI-driven ecosystem for political operations. From the outside, it presented itself as a tool for fighting disinformation.

• Targeting constituency by constituency, based on real census and electoral data, covering all 222 constituencies in the country and aiming at the most sensitive fault lines: race, religion, the monarchy.
• A pool of more than 1,000 fake X accounts, each with warm-up logic that made it pass for an ordinary account before use, with cookies and addresses renewed. The dashboards set the number of artificial views served to each target: the report mentions a request for one million views on the account of the sitting Prime Minister.
• A fake media outlet that harvested real Malaysian articles, had them rewritten and republished them under fabricated bylines, along with content from Russian and Chinese state media stripped of its attribution, presented as local journalism.
• Fabricated intelligence files accusing a named opposition figure and civil society organisations, without any corroboration, including in the model's own research.

Two details matter. The model refused several times, notably after identifying a document as political smear material: the actor then negotiated sanitised wording to build the same capability. And the operator was seeking a contract with the national communications regulator, with no success recorded.

When AI enters a real newsroom #

The report distinguishes two worlds. Most covert networks reach nobody: the majority of the content discovered drew no authentic engagement. Real reach appears when the channel is an existing state media outlet: FM radio, satellite and shortwave radio, global television.

This is case GTG-24015: four accounts used the model as an editorial desk for Russian state media, delivering finished content directly into the production chain. A former editor-in-chief of the Moldovan edition turned the Romanian and Moldovan press, polls and opposition publications into Russian-language articles picked up by a state Telegram channel and by a national agency, with fake verification loops: the same information relayed by several outlets so that it appears independently confirmed. He also amplified fabricated defamatory claims about the Moldovan president ahead of the vote on 28 September 2025.

The other three accounts follow the same model: a contractor writing in Latin American Spanish under editorial supervision, another producing for Africa according to an in-house style guide of forty rules, and a state media employee producing banners, captions and voice-overs to the exact character count, from Russian news wires and material from foreign intelligence and the Ministry of Defence. In at least one confirmed case, this material went on air.

Another variant, in the Central African Republic, is case GTG-04001: a Russian-speaking operator in Bangui fed a local FM radio station (set up and funded by the Wagner group in 2017, according to an investigation cited by the report) and got his content onto the national broadcaster by trading airtime for places on a Russian training programme for foreign journalists. He also had the model produce the team's employment contracts, with a loyalty clause to the country's president and to Russia and its contingent, along with job descriptions, article scoring grids and a three-warning dismissal procedure, which he then used to decide whom to keep and whom to fire. When the model flagged the political nature of the scoring grid, the actor rephrased it in neutral terms and kept the scoring.

The same actor produced fake government documents (communications from the gendarmerie and the Ministry of Defence) from the original layout files, and kept a tracker of opposition figures up to date. This is the passage that best shows that AI is not only used to write content: it sets up the administrative apparatus of an influence operation. The model refused the most aggressive request, to name real individuals as militants in order to draw the security forces onto them; the actor fell back on an anonymous source. It is the only operation in the chapter rated category four.

Impersonating a real person #

One case stands out, because it no longer targets an audience but named individuals. An operation linked to an Iranian opposition organisation in exile cloned a real activist's messaging account. The model was instructed, in Persian, that it was this person; it was given around 8,400 of his public messages to read in order to copy his style; then it chatted live with his contacts, who did not know, Anthropic writes, that they were talking to a machine.

The same network had harvested more than 500 channels to profile people inside Iran, grouped by city, age, profession, political leaning and by arrest history, in a country where these people risk prison or worse. It analysed around 51,944 archived messages to build psychographic files on dozens of named individuals. The whole thing ran on a shared agent platform where each workspace maintained its long-term memory files: banned words, approved sources, avoidance rules. One actor had loaded the movement's founding doctrine into it as strategic baseline data that others could reuse.

A fake NGO before an international body #

Case GTG-84002 is the most troubling for anyone who works with institutions. A single actor ran, on his own private platform, a persona driven by a master doctrine file that reassigned the same mission to the model across hundreds of sessions. Five workstreams at once: a network of around 300 fake influencer accounts, centrally funded and coordinated; a fake NGO copying the identity of a real organisation, which published under its name reports written by the sponsoring state; official testimony written for two people, intended to be delivered at the 62nd session of an international human rights body, under an explicit constraint never to mention the sponsoring country; the profiling of 18 Members of the European Parliament and of journalists; counter-files targeting critical special rapporteurs. An internal report described the network's “independence” as its “greatest strategic asset”.

4,700 personas, 25,000 people, two weeks #

The “scams” chapter contains only one case, but it is spectacular. A Chinese studio built a network of more than twenty dating apps and ran the personas chatting on them, while selling the service as entirely human. Over two weeks in April 2026: more than 4,700 distinct personas, at least 25,000 real people, 2.36 million messages, through infrastructure that resold access to the models.

• Three artificial personas for every real human. The targeted user scrolled through a feed made up of 75% personas and 25% real people, with no way of telling them apart. The studio recruited these gig workers by invitation and paid them per message, per video call and per subscription generated: the things the machine could not do. These people were themselves assisted: another model suggested three replies to choose from with a tap.
• Several AI providers, each in a distinct role: conversation here, face scoring and moderation there, avatar generation elsewhere.
• An explicit operating instruction: never reveal that you are automated, dodge requests for video calls or photos, follow a fixed sequence of steps. The system generated fake likes, fake visitors and pre-recorded videos, and tracked who was beginning to suspect a bot.
• Apps designed to pass app store review: an interface switch that only activated during the platforms' review, class names varied across more than twenty variants to defeat similarity checks, payment redirection that could be switched on from the server side, and therefore hidden.

Anthropic notes an uncomfortable point, which shows the limits of guardrails in context. Seen from inside a conversation, nothing distinguished this setup from an ordinary chat companion: neither the monetisation nor the deception was visible from the conversation. In a few exchanges, users revealed a serious illness or acute distress; the model's reasoning noted the problem, and the reply carried on in character.

What a company does with all this, on Monday #

The practical conclusion comes down to one idea: nothing that looks like a person is proof of identity any more. Not a photo, not a voice, not a face on a video call, not a familiar writing style.

1. The second-channel rule, written down and displayed. No bank transfer, no change of bank details or access on the strength of a call, a voice message, a video or an e-mail, without calling back on a number you already know, never the one given in the request. It is the only measure that holds up against a perfect fake, and it costs nothing.
2. An internal verification password for sensitive requests between management and accounts. Old-fashioned, effective, impossible for a machine to reproduce.
3. A recruitment process that checks people exist. Anthropic's August 2025 report already documented operators landing technical jobs without being able to code. A live video interview with unpredictable questions, identity checks on hiring, caution with remote profiles whose references cannot be traced.
4. Monitoring of your own brand. Lookalike domains, fake profiles of your directors, fake reviews, articles quoting you on unknown sites. Hence the value of properly maintained, signed DNS and a locked-down e-mail domain: impersonation often starts there.
5. A source verification rule for anything that feeds into a decision: two sources whose publisher you know, and suspicion of information “confirmed by several outlets” that might be only one laundered source. Certainty laundering consists precisely in making the caveats on a claim disappear by circulating it.

Tomorrow, the last instalment: the extreme cases (missiles, autonomous drones, biological research) and what they say about choosing an AI provider. With the checklist that sums up the ten days.

Sources #

• Anthropic, Detecting and countering misuse of AI: September 2026 (10 September 2026): Influence operations (pages 41-80) and Scams and fraud (pages 139-142) chapters.
• Cases cited: GTG-04001, GTG-54002, GTG-84005, GTG-24015, GTG-34001, GTG-54006, GTG-84006, GTG-54004, GTG-84002 and GTG-15001.
• Anthropic, Detecting and countering misuse of AI: August 2025: on operators infiltrating technical jobs.
• Our first article on the subject: AI is already hacking: fourteen months that changed the threat.