Anthropic said Thursday that Iranian state-aligned and Iran-linked accounts used Claude in separate operations involving propaganda, targeting US naval forces, domestic surveillance and profiling people in Israel and the Jewish diaspora.
The report covers malicious activity Anthropic said it disrupted between December 2025 and August 2026 across several areas, including cyber operations, influence campaigns and surveillance.
In one set of influence operations, Anthropic said it identified and removed three Iran state-aligned accounts linked to government propaganda institutions. The accounts used Claude to develop campaigns intended to shape opinion inside and outside Iran while disguising state-backed narratives as independent content.
The company linked the accounts to the Islamic Culture and Communications Organization under Iran’s Ministry of Culture and Islamic Guidance, the Islamic Propaganda Office of Khorasan Razavi and the Islamic Propaganda Organization’s Bina Cultural Observatory.
Anthropic reported that the accounts used Claude to produce campaign plans, doctrine manuals, persona systems and target databases and to turn official government intelligence bulletins into tailored material in Farsi, Arabic, Urdu, Malay, Spanish and English, with a broader plan covering 20 languages. The material was distributed through platforms including X, Instagram, Telegram, TikTok, YouTube, Eitaa, Bale and Rubika.
Some of the content was disseminated through channels sympathetic to IRGC narratives, with Anthropic saying it observed material appearing on IRGC-aligned channels on Iran’s Eitaa platform and elsewhere. The company assessed the operation as Category Three on its Breakout Scale, reflecting distribution across multiple platforms.
Anthropic also reported that an account linked to the Bina Cultural Observatory generated messaging in the official voice of an IRGC spokesperson. During the 2026 US-Israel-Iran war, the network attributed false claims to Western research institutions including CSIS, Brookings and RAND to make state-backed messaging appear more credible.
The report also detailed a separate Iran-linked account that Anthropic said used Claude to collect and analyze publicly available information to develop targeting recommendations against US naval forces in the region. The account used Claude to compile targeting handbooks and identify and track naval positions through open-source information.
According to Anthropic, the material included names of US personnel collected from captions on public military photographs, ship and aircraft transponder identifiers, commercial satellite-imagery query scripts and lists of public websites exposing US naval movements. The account also used Claude to research vulnerabilities in shipboard systems, including maritime satellite terminals, Cisco communications equipment and industrial control products.
Anthropic said the same account separately used Claude to develop components for an Iranian state domestic surveillance platform combining automatic license-plate recognition with interception of mobile-device identifiers. It also analyzed a same-day export from a private Telegram group with 244 members, including mapping social connections among its members.
In another case, Anthropic identified an Iran-linked account that used Claude to build an automated open-source intelligence tool for profiling hundreds of people in Israel and the Jewish diaspora. The account sought to produce intelligence on Israeli and US individuals. Separately, it used Claude to modify malware and build an obfuscation pipeline intended to make the malware harder to identify and analyze.
Anthropic also identified a separate Iranian operation that used free Claude accounts to develop malware, phishing infrastructure and delivery pages targeting people inside Iran. The pages were designed to deliver malicious material only to users connecting from Iranian IP addresses and included sites posing as censorship-circumvention tools and a fabricated Farsi news outlet.
The company said it banned accounts associated with the operations and, in the US naval reconnaissance case, shared threat intelligence with government authorities. It also said it shared indicators from the Iran state-aligned influence operations with industry and research partners.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.