Claude Influence Operations: Anthropic Bans Nine Campaigns

What happened

Anthropic has published a detailed account of how governments, state media outlets and paid propaganda firms used its Claude models to run influence campaigns. The company's September 2026 threat intelligence report covers nine influence operations. They came from Russia, Iran, Turkey, the Gulf, South Asia, Africa and Europe, and they aimed content at audiences on six continents.1 The operators were a mixed group: governments, state-aligned propaganda bodies, state media, private firms that sell influence to clients, domestic political operators and, in one case, an opposition movement in exile.11

The influence cases are one part of a much longer report. It covers misuse that Anthropic's Threat Intelligence team found and disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams, biological misuse, conventional weapons and illicit distillation.612 Some outlets put the document at 154 pages.16 Anthropic says every misuse case ran on its Haiku, Sonnet or Opus models. It says its newest Fable and Mythos-class systems were not involved, apart from one distillation case.1318

The influence findings matter most for anyone tracking elections and information integrity. They show a shift from AI as a writing aid to AI as the operational core of a propaganda campaign.

From content mill to newsroom

Anthropic says its first threat report covered a single commercial influence-as-a-service network. Since then it has found larger and more sophisticated operations that use Claude to build fake social media profiles and whole news sites while hiding who is behind them.11

The largest commercial case is a network of roughly 70 fabricated news websites. Claude wrote original articles for these sites and also rewrote real reporting by legitimate journalists into slanted versions aimed at particular national audiences. About 70 matching X accounts and more than 250 fake commenter accounts amplified the output.11 The Straits Times named the operator as LKM Company, a French advertising agency, and reported that it published at least 8,913 stories in about 20 languages. Its targets included the US, Brazil, France and the Democratic Republic of Congo. The network had no fixed politics and changed sides depending on who was paying, which Anthropic says fits the influence-as-a-service model.11

The Russian cases look different. Instead of building new fake infrastructure, individual actors used Claude as an editorial desk inside existing state media operations. Anthropic assessed with high confidence that Claude-generated content was published through outlets including Sputnik Moldova, RIA Novosti, Sputnik en Español and Sputnik Africa.1 One account was linked to a former Sputnik Moldova editor-in-chief who amplified fabricated claims about President Maia Sandu ahead of Moldova's September 2025 parliamentary election.6 One security firm's analysis of the report says a single actor produced articles at a volume that would normally need a full editorial team. It also highlights what the report calls a "false verification loop": the same claim repeated across outlets until it looks independently confirmed.14

In the Central African Republic, Anthropic says an actor ran a daily content operation through Radio Lengo Songo. The work was coordinated with RT, Sputnik Afrique, TASS and the Russian House in Bangui, and Claude was told to build pro-Russia, anti-France talking points into its stories.1 According to one summary, the actor also produced forged government documents. Anthropic linked the station to a Wagner-descended influence unit that it believes came under Russian foreign intelligence control in late 2023.6

Iran, the Gulf and a Turkish vendor

The Iranian cases show how far the tools can go inside a state apparatus. Anthropic removed three accounts tied to named propaganda institutions: the Islamic Culture and Communication Organization, the Islamic Propaganda Office of Khorasan Razavi and the Bina Cultural Observatory. These groups described their work as "soft war" or "cognitive warfare."1 Claude access is blocked inside Iran, so the operators used VPNs and foreign phone numbers. Even so, they repeatedly named their institutions and roles in their conversations with the model.1 Al-Monitor reported that the accounts used Claude to write campaign plans, doctrine manuals, persona systems and target databases.4 Al Jazeera noted that one operation was a command room in a Mashhad seminary that distributed content in line with IRGC narratives.5

The report also covers a UAE-directed operation against the Muslim Brotherhood. It ran an AI persona called "Deadshot" and used Claude to produce intelligence-style briefs, ghost-written testimony and targeting lists, some of them prepared for senior UAE officials.1 Coverage says the campaign also went after UN experts who had criticized Abu Dhabi's alleged role in Sudan's war.34

A separate case involves an operation aligned with the Iranian opposition group MEK/NCRI. It used a shared agent platform, cloned a real activist's voice from private messages, and impersonated that person in live conversations with contacts inside Iran.11 In Malaysia, Anthropic tied roughly 1,000 fake accounts to an Istanbul technology firm that sold the system as a paid political-operations product. Claude refused some psychological-operations wording, and the operators rephrased their prompts and carried on.16

Where the coverage agrees and diverges

Outlets agree on the basic facts: nine operations, several state-linked, all disrupted. They differ on what those facts mean.

POLITICO pointed to Anthropic's own caveat. Most of the AI-generated content in these operations got little or no authentic engagement before it was caught, and the campaigns scored between two and four on the six-level "breakout scale" researchers use to measure reach. OpenAI and X have said the same about operations on their platforms.2 The Next Web made the same point.12 That framing is accurate, but it can mislead. One analysis says Anthropic rated the Central African Republic radio operation at Category Four, the top of the range reported for these cases.6 The Russian state-media cases also did not need to build an audience from scratch, because their content went straight into outlets that already had one.1

Other commentators are harsher. One critique argues that disruption came only after the work had begun, and that the product was already serving espionage crews and political-operations vendors when the cases were closed.16 Some cybersecurity coverage notes that banning accounts does not mean the operators lost the content or tools they had already produced.7

The engagement numbers are not the main story. Influence operations have always mostly failed to reach people; what has changed is how cheap it is to keep trying. POLITICO quoted the report's point that commercial vendors who "produce content for whoever wishes to pay" give the real sponsors plausible deniability. They also put this capability within reach of actors who could not or would not build it themselves.2 The most consequential finding is a lower barrier to entry, not a breakthrough in persuasion.

The model as an operations layer

The theme that links the influence cases to the rest of the report is that Claude is increasingly running whole workflows, not just writing text. Coverage of the report says malicious actors now use AI to plan, execute and automate entire operations, not only to answer questions.17 In the Iranian cases, Anthropic described Claude as the "main administrative and operational layer" of the propaganda operations.1

The same pattern appears in the surveillance cases next to the influence findings. In what Anthropic called its most operationally mature case, a PRC-aligned actor with no Arabic skills used Claude to run a multi-day recruitment operation aimed at Uyghurs in Syria. The model drafted messages in Syrian Arabic, translated replies in real time and planned a campaign to discredit journalists at the Uyghur Post.15 Here the line between influence work and repression disappears.

Why it matters now

The timing points to the midterms. On October 14, Anthropic said it had added classifiers to catch multi-step misuse, such as building fake social accounts and news sites for political discussion. It also said it had improved detection of election-related activity by foreign state actors.10 The company disclosed that foreign-based operators of a fake news site used Claude to write US midterm coverage favoring Russian, Iranian and North Korean narratives. Other actors used it to produce fabricated news aimed at earning advertising revenue from American readers.10 Separate reporting on the announcement noted an admission that matters: Claude generally refused openly harmful requests but could miss coordinated campaigns made up of tasks that each looked harmless.9

That gap is the real lesson of the report. Refusal-based safety works against people who say plainly what they want. It works much less well against operators who split a campaign into routine-looking pieces such as rewriting an article, translating a reply or formatting a dashboard. Anthropic's detections depended on looking at patterns of behavior, not on the model refusing individual prompts.

There are reasons for caution. Anthropic is reporting on itself, many of its attributions cannot be independently checked, and some of its other claims, such as naming Chinese labs in the distillation section, remain publicly uncorroborated.7 The company also describes the cases as among its most notable and novel findings, not typical usage.15

Still, the overall direction is clear. State propagandists and paid vendors are now using frontier models as the production line for influence campaigns. The open question for the midterms is whether behavior-based detection can keep up with operations that break their work into harmless-looking steps.