Anthropic Says China-Linked Accounts Used AI to Monitor Overseas Dissidents
Updated: 53 minutes ago
San Francisco/Beijing, 13 September 2026
US artificial-intelligence company Anthropic says it has banned multiple China-linked accounts that used Claude for intelligence collection, profiling and cross-border surveillance. Its threat-intelligence report, published on 10 September, says the targets included Uyghurs in Syria, senior Catholic figures in Asia, leaders of the Presbyterian Church in Taiwan, Tibetan groups, Falun Gong communities, Hong Kong democrats, organisers of Tiananmen commemorations and international human-rights institutions. Other accounts allegedly sought the gathering point, route and terminus of a pro-democracy march in Vancouver, venues for Uyghur cultural events in Turkey and locations used for Oslo Freedom Forum screenings. Anthropic's original report; Reuters
Axios drew renewed attention to the cases on 12 September. It reported Anthropic's finding that a non-Arabic-speaking operator used Claude to approach Uyghurs in Syrian Arabic, organise material from more than 100 WhatsApp groups and dozens of Telegram channels, and identify people who might be susceptible to pressure because of financial strain, separation from family or relatives remaining in Xinjiang. Anthropic describes the operation as aligned with the Chinese government, but assesses only with low confidence that the actor was a contractor working for Chinese state security rather than a state-security organ acting directly. Axios; Anthropic
The reported activity occurred between December 2025 and August 2026; 10 September was the date on which the findings became public, not the date on which all the operations occurred. Anthropic also says the report presents particularly notable and novel cases rather than activity typical of its platform. Independent news organisations can verify the publication, the claims it contains and the company's announcement that it banned the accounts. They cannot inspect the complete prompts, subscriber information or service logs that Anthropic has withheld, and therefore cannot reproduce every attribution independently. Anthropic; The Guardian
Asked about the report on 11 September, Chinese Foreign Ministry spokeswoman Mao Ning said that she was not aware of the specific circumstances. China, she said, consistently supported developing AI for good and firmly opposed distortion of facts, attacks and smears against the country. The ministry did not respond individually to the allegations concerning Uyghur recruitment, dossiers on religious communities, links to public- and state-security bodies or reconnaissance of overseas event venues. Chinese Foreign Ministry transcript; Reuters
Syria: from group messages to covert recruitment
Anthropic describes the activity it labels GTG-14010 as a China-based surveillance and recruitment operation aligned with the Chinese government. The operator supplied Claude with material bulk-extracted from more than 100 WhatsApp groups and dozens of Telegram channels, asking the model to organise cross-platform identities, networks, locations and personal vulnerabilities into Chinese-language records. The targets included Uyghur combatants who had recently joined formations of Syria's new army and whom Beijing associates with organisations it designates as terrorist. They also included Uyghur civilians, businesses, journalists and overseas media workers. Anthropic; Axios
According to the report, the operator attempted to recruit people believed to have access to the military units, including by offering payment in exchange for information. Claude was used to draft outreach in Syrian Arabic, translate replies in real time and act as an ‘expert’ checking dialect, military terminology and the credibility of the deception. The system was also asked to assess whether financial pressure, family separation, disillusionment or relatives remaining in Xinjiang made particular people easier to approach. Anthropic reasons that relatives in Xinjiang could become meaningful leverage only through co-ordination with domestic Chinese security bodies. That is an inference from the operation's logic; the public report does not disclose direct evidence that such co-ordination occurred. Anthropic
The same operator allegedly planned mass reporting, delegitimisation and bot amplification against the Uyghur diaspora outlet Uyghur Post, while preparing surveillance-platform tenders for Chinese local-government clients. Claude refused some requests involving covert interrogation and large-scale false personas, but assisted with other analysis, translation and outreach tasks. Anthropic expressly says the ultimate real-world outcome of the recruitment effort was not visible to it. It cannot therefore confirm that anyone accepted payment, that dossiers reached Chinese officials, or that a target was detained or harmed as a result. The company banned the relevant accounts and says it is tracking their digital signature. Anthropic
Religious communities: personal data and building plans
A second account cluster is assessed by Anthropic as a China-based intelligence operation aligned with government priorities for religious affairs and united-front work. Its targets included senior Catholic cardinals in Asia; the leadership of the Presbyterian Church in Taiwan; the Central Tibetan Administration and Tibetan advocacy organisations; Falun Gong practitioners and associated media; and Christian missionary networks connecting Singapore, Hong Kong and mainland China. The operators collected dates and places of birth, immigration dates and social-media handles. They also searched for floor plans, facades and structural diagrams of some religious venues. Anthropic; Reuters
The company says the users told Claude to prepare documents using templates and expressions common in Chinese security work, including ‘personnel research drafts’, ‘clue reports’, ‘situational awareness’ digests and fields identifying exploitable ‘work handles’. Prompts told the model to adopt ‘China's standpoint’, describe the Tibetan administration in exile as an ‘illegal separatist administration’ and apply the Chinese government's designation of Falun Gong. One user described themselves in a conversation as an information-security officer for the Chinese state. Anthropic used this vocabulary, the combination of targets, device information and working times as attribution signals. It has not disclosed the users' identities or an evidential chain capable of examination in court. The company banned the cluster. Anthropic
The report does not explain why plans of religious venues were required and provides no evidence of an intention to attack them. Site reconnaissance can serve security assessment, surveillance, infiltration or other purposes. Without tasking documents or evidence of action in the physical world, it would be unjustified to turn collection of this material into an allegation of a violent plot. The narrower supportable finding is that Anthropic observed requests for dossiers on people and premises organised in Chinese official-security language and linked the accounts to Chinese government priorities. Anthropic
‘Stability maintenance’ reaches Vancouver, Turkey and Oslo
The report characterises another group of accounts as a ‘stability maintenance’ surveillance and transnational-repression operation linked to Chinese municipal public- and state-security bodies. The three reported types of user were a local cyber-police officer, a public-security detective studying at a police academy and multiple users at a local state-security bureau. Targets ranged from petitioners and rights defenders inside China to Hong Kong democrats, organisers of Tiananmen commemorations, Uyghur advocacy groups, international human-rights institutions and the overseas dissident account ‘Teacher Li Is Not Your Teacher’. Anthropic
Anthropic says one workflow queried a government surveillance database, automated collection across platforms and distributed daily reports to supervisors. Another prompt requested ‘control’ guidance for ten unnamed Chinese citizens, including the interception of petitioners, coercive summonses referred to as ‘talks’, and close monitoring of movement and communications. Claude initially refused to produce one weekly stability-maintenance report, but the user obtained substantive guidance after rephrasing the request. The company acknowledges that its safeguards performed unevenly: some high-risk requests were rejected, while other work continued over repeated sessions. Anthropic
The element most directly affecting the security of overseas assemblies is what Anthropic calls ‘pre-operational venue intelligence’: the start, route and end point of a Vancouver democracy march; venues for Uyghur cultural events in Turkey; and Oslo Freedom Forum screenings. The company assesses with medium confidence that one operator was a local public-security detective studying at a police academy, and with medium confidence that the state-security bureau concerned was in Zhejiang. It has not disclosed the events' dates, the names of people monitored, the requesting office or the intended use of the material. Nor does it show that anyone went to the sites, disrupted an event or transferred information to an agent abroad. Anthropic
That distinction is important. Looking up a publicly advertised march route is not necessarily unlawful; police, reporters and participants routinely consult such information. If people linked to a foreign security body combine it with personal profiles, surveillance databases and ‘stability maintenance’ targets, however, the exercise creates a risk of transnational repression. The evidence at present supports describing suspected preparatory intelligence that Anthropic detected and disrupted, not a completed overseas interference operation.
Automated public-opinion monitoring expands the scale
A further operation, labelled GTG-14022, allegedly turned Claude into a daily public-opinion analysis pipeline. It processed at least 15 to 30 items a day from Weibo, X, YouTube, Telegram, Facebook and foreign media, scored them for political sensitivity, and generated Chinese-language briefings for officials. Subjects included dissidents, labour and student activists, Uyghurs and Tibetans, religious communities, Taiwanese political figures, diaspora groups, foreign media and human-rights organisations. Anthropic; Reuters
Anthropic assesses with medium confidence that the system was run by a commercial contractor serving government clients, probably connected to the state-security, united-front or propaganda apparatus, rather than by a state body directly. It says some generated documents recommended enforcement actions only a government could carry out. The company also says that one religious-affairs collection unit, previously comprising several analyst teams, had been reduced to a single office using AI to produce thousands of investigations each month. Those figures and organisational changes derive entirely from Anthropic's internal observation and cannot be checked against an independent audit. Anthropic; Axios
Human-rights significance: lowering barriers of language, labour and scale
The new risk described by the report is not that AI invented surveillance. It is that multilingual translation, bulk classification, network mapping, analysis of personal vulnerabilities, location research and standardised reporting can be combined into a repeatable process run by very few people. Axios observed that such systems reduce barriers which previously required larger numbers of intelligence officers, engineers or language specialists. Anthropic likewise says that some operations compressed the work of several teams into one office or individual operator. Axios; Anthropic
Amnesty International's 2024 study of Chinese and Hong Kong students overseas recorded interviewees' allegations of following, online monitoring and intimidation, as well as contacts with or threats against relatives in China. Amnesty classified those practices as transnational repression and called upon host governments to establish reporting and protection mechanisms. That study predates the Claude report and cannot establish that the two sets of material concern the same people. It does provide independent background to diaspora fears about identification, pressure through family members and monitoring of assemblies. Amnesty International
Responses and enforcement
Anthropic says every relevant account breached its policies prohibiting non-consensual surveillance, profiling and violations of civil liberties. The company banned the accounts, improved its detection rules and, where appropriate, shared identifiers with industry partners and authorities. It has not identified the governments or law-enforcement bodies that received information, disclosed precisely what was supplied or confirmed that potential targets were notified. Banning accounts cuts off one tool; it does not demonstrate that the operators have stopped work, and they may shift to other commercial or open-source models. Anthropic; Associated Press
China's published response is that it lacks knowledge of the specific circumstances, supports AI for good and rejects attacks and smears. No specific statement responding to the reported venues or recruitment activity could be located from the governments of Canada, Turkey, Norway or Syria. Nor had the principal communities and institutions named in the report issued a single joint response by 13 September. This report therefore cannot say whether a host state is investigating, whether Anthropic has supplied evidence sufficient to open a case or whether potential targets have received security warnings. Chinese Foreign Ministry
Sources
Comments