Every couple of months now, Anthropic releases a document, which is less a blog post and more a counter-intelligence briefing. The latest, which revealed that the company was wiping out a group of accounts connected to state-affiliated operators in China, Iran and multiple African markets that had been attempting to get the Claude models to do surveillance work, comes on the heels of a trend that has grown too distinct to overlook: The same AI models that are being sold to consumers and enterprises around the world are being tested day by day by intelligence agencies seeking a quick win on their next operation.

It's not a one-time deal. Last November, Anthropic revealed that a group allegedly affiliated with the Chinese government, known as GTG-1002, exploited a form of autopilot cyber-espionage using Claude Code to perform about 80 to 90 per cent of the technical work required for the attacks on approximately 30 organisations, such as technology companies, banks, chemical manufacturers and government agencies, achieving success in only a few cases out of hundreds, before closing it down. All of that revelation amounted to a painful industry revelation: agentic AI had transitioned from theoretical vulnerability to operational tool for state actors, and it had been happening in a commercial product, months before anybody outside its development was aware.

The China component of the new takedown is part of a larger narrative of Beijing's surveillance-technology being exported from inside the state to outside. Over the past decade, researchers say, Chinese vendors have sold camera networks, facial-recognition suites and data-fusion platforms as smart-city infrastructure in dozens of African capitals, all of which have been used, repurposed and developed as tools for tracking dissidents and political opponents. What Anthropic's report brings to the top of the stack is the code and the structure of the databases and how the intercepted material is interpreted in a general purpose language model and then presented to the software, which effectively turns a camera network into an automated profiling system.

Iran is another problem, but one that is similar. But now, after the kinetic conflict that erupted in the region earlier this year ended, Iranian state security has definitely turned its gaze back to its more traditional focus: detecting and monitoring citizens that pose a threat to the country's internal stability. Recorded Future's Insikt Group has found an Iran-nexus cluster, TAG-182, that includes Android surveillance malware that specifically targets Iranians at home and abroad and shares code with older clusters like Ferocious Kitten.

In an independent report, Israeli researchers at the Institute for National Security Studies (INSS) have stated that the Chinese camera networks deployed around the region creates a double-use threat that can be used by other intelligence agencies, such as Iran's, in order to obtain intelligence about the region. On top of that there's a documented influence operation, identified by Citizen Lab, and allegedly connected to Israel that has been running over half a dozen fake accounts pushing Iranians to unrest, and, in this theatre, AI-powered influence campaigns are running both ways.

All this is not taking place in a vacuum, commercially, with Anthropic. Much of this year the company has been in conflict with its own government over the very opposite issue that Washington should be given permission to use Claude for domestic spying and as an autonomous weapon system. This was a supply chain risk that the Pentagon called it, an order by the president prohibiting any federal agency from purchasing its products, and a lawsuit brought by Anthropic to federal court. From that perspective, it's not so much a matter of opportunistic public relations as it is a matter of sticking to the same policy regardless of who's asking and what happens if they're not?

The enforcement operation is not limited in scope. According to its transparency disclosures, Anthropic had 1.1 million accounts banned in the second half of 2024, and by the first half of 2025, this figure had fallen to 690,000 accounts, only to nearly double again to 1.45 million in the second half of 2025 as systems became more mature and the user base grew. Fewer than half of the appeals to those bans are ever rejected, reflecting the company's careful design of the limits on what is considered acceptable use.

But there is a wider industry reaction to these takedowns and it is a commercial reaction, not a security one. Meta has also separately said it has blocked whole “surveillance-for-hire” networks from accessing its services which it estimates are used against fifty thousand targets in more than a hundred countries, and OpenAI has reported their own instances of Chinese-backed actors trying to build social-media-monitoring solutions based on its models.

The common denominator: frontier AI labs are increasingly being seen as the first line of defense against the very things they developed, since there is no government export-control program in place for a subscription to a chatbot. As a result, the market for identity verification and fraud-detection technology is expected to more than triple by 2034, to over 50 billion dollars worldwide, with both enterprises and governments paying for their ability to determine who or what is on the other end of a digital interaction when the assumption that a human was at the keyboard is no longer valid.