Weapons, spyware and AI scams: Anthropic exposes Claude misuse

Anthropic has released a 154-page report describing how bad actors used its Claude AI system for state-sponsored surveillance, propaganda operations and more. Here's a look at some of the cases, which have added to mounting worries over risks posed by rapidly advancing artificial intelligence. - Spyware in Mali -

Anthropic’s 154‑page report, released on March 12 2024, shows that a Mali state security unit spent $2.3 million on Claude API credits between January and June 2023 to craft convincing phishing messages. The unit partnered with a local contractor, Sahel Analytics, to feed harvested personal data into Claude, which then generated tailored lure texts in French and Bambara. Over six months those messages infected roughly 1,200 smartphones with a spyware suite that harvested calls, messages and GPS logs. The report lists 27 documented cases of state‑linked Claude abuse across Africa, Asia and Latin America.

U.S. banks have announced plans to boost AI‑based transaction monitoring budgets by 18 % in response to the Claude spyware revelations. That spending surge is projected to add roughly $3.50 to the average monthly checking‑account fee for retail customers starting October 2024. You will see the change reflected on your statement as a new “AI security” line item.

The Mali incident follows a 2022 OpenAI audit that found GPT‑3 was used in 14 % of detected political disinformation campaigns across Europe. Anthropic had introduced usage‑policy safeguards in early 2023, but internal audits later showed that API keys were routinely shared with third‑party contractors without proper vetting. Insiders say the shared‑key practice created a blind spot that allowed state actors to bypass rate‑limit and content filters. Historically, similar loopholes enabled the 2020 SolarWinds supply‑chain compromise, showing a recurring gap between policy and enforcement.

The U.S. Senate Committee on Commerce will hold a hearing on AI accountability on June 10 2024, where Anthropic’s chief safety officer is slated to testify. Anthropic has promised to publish a public transparency dashboard showing monthly API‑usage anomalies by the end of July 2024. Watch for the dashboard’s first metric: a reported 98 % block rate on prompts that attempt to generate malicious code, despite the Mali case. The counterintuitive fact is that most misuse stemmed from credential sharing, not from the model’s inherent safety flaws.