A commercial surveillance platform using AI to profile social accounts: GTG-54009 case

What happened

In June 2026, we banned an account that used Claude to build a commercial surveillance platform for analyzing, classifying, and profiling the social media activity of users in Iran and the Persian Gulf region. Our investigation found that the activity was carried out by, or on behalf of, an entity called 'S2T Unlocking Cyberspace'; open-source research suggests this is an Israeli–Singaporean commercial intelligence firm.

The platform's core purpose was surveillance: tagging the location of social media users, sorting people into coded demographic groups, and generating intelligence briefings in formal Arabic that read like government documents.

Our findings independently corroborate a February 2023 investigation by the Forbidden Stories journalism network; that investigation documented a surveillance product by S2T, which journalists discovered in a company brochure within leaked Colombian military files. The capabilities described in the brochure closely match the behavior we observed in this operation.

We identified the operation during its pilot phase and found no evidence that later stages of S2T's surveillance chain (as described in the Forbidden Stories report) were used against real targets before the ban.

What the AI did

The actor was building a multi-brand system portfolio, likely serving Arabic-speaking clients in the Gulf region.

The system captured and classified the location of diaspora social network users, categorizing them as pro-government or anti-government.

A demographic scheme with six population groups (urban, religious, military, youth, diaspora, rural) was used to classify people.

The final briefings were written in formal Arabic in the style of official government communications, including sentiment scores broken down by Gulf nationality and suggested counter-narratives.

The report shows that the actor handed roughly 25 social media posts to Claude at a time, asking it to analyze the poster's demographic group, location, and political leanings, and to give a confidence score for each judgment.

In addition, the actor had Claude generate posts in Persian, Arabic, English, and German for suspected fake online identities — designed to look like ordinary users on both sides of a political camp, which the report believes was to build credibility for a large number of fake accounts.

What the report observed

The report describes several product lines of the platform, likely aimed at Arabic-speaking clients in the Gulf region; the system categorized diaspora social network users by location and tagged their stance.

The report also lists a parallel workflow: over 255 synthetic social accounts, divided into different groups such as diaspora, youth students, and military. The report emphasizes that it identified the operation during its pilot phase and found no evidence that it entered later stages targeting real targets before being banned.

Notably, the report's own honesty boundary: Anthropic says it cannot independently confirm the downstream steps reported in the media, such as infiltrating private groups and phishing.

Confirmed & unknown

Platform response

Anthropic banned the relevant accounts, stating this violated its usage policy prohibitions on surveillance, profiling, and coordinated inauthentic behavior, and shared indicators with partners tracking 'surveillance-for-hire' actors.

Limits of response：Banning accounts only interrupts their use of Claude; the report does not claim the platform as a whole stopped operating.