A China-aligned operator used Claude, Anthropic’s generative AI assistant, to track Uyghurs living in Syria and recruit potential informants within the community. The model translated messages, facilitated communication in local dialects, and geolocated people, zeroing in on particularly vulnerable individuals who face financial hardship or separation from family members still in Xinjiang, the autonomous region in northwest China that is home to the majority of the Uyghur population. Claude helped the operators turn scattered digital traces into targeted intelligence, amplifying the reach of China’s surveillance of a persecuted ethnic minority.
The case is one of several examples of AI-enabled digital transnational repression detailed in a recent report by Anthropic’s Threat Intelligence team, published on Sept. 10, 2026. The report gives direct evidence that generative AI is being incorporated into the machinery of cross-border repression, enabling authoritarian governments and their proxies to build scalable workflows for identifying, monitoring, and targeting diaspora activists and exiled dissidents around the world.
Because these operations target people across jurisdictions and can enable offline coercion, AI companies should treat transnational repression as a distinct threat category, separate from domestic surveillance and influence operations. Frontier AI companies—those building highly capable, general-purpose AI models—should follow Anthropic’s lead and publish detailed reports that specifically track incidents of digital transnational repression. They should also establish protocols for detecting digital transnational repression, publicly notifying affected communities, and preserving evidence captured in the course of their threat investigations. Taking these steps would help curb the misuse of American technology by repressive governments reaching across borders and improve protections for the already vulnerable groups they are threatening.
AI-enabled Digital Transnational Repression
Digital transnational repression refers to a government’s use of digital technologies to intimidate and silence dissidents and other opponents living in exile and in the diaspora. With methods ranging from hacking and surveillance to online harassment and coordinated defamation, governments expand the reach of political coercion far into other territories and deep into the personal lives of their targets. Moreover, these digital attacks can set the stage for physical threats against exiles, including stalking, assault, kidnapping, and even assassination.
Transnational repression can have devastating effects on targeted individuals, as well as on the fabric of democracy more generally. Our interviews with affected persons show that transnational digital threats instill distress, fear, and uncertainty among exiles and diaspora communities, weaken their sense of safety and wellbeing, undermine social relationships and cause isolation, foster self-censorship, and withdrawal from activism. In short, digital transnational repression severely impedes civil society’s continued ability to use digital tools to exchange, organize, and mobilize freely across borders.
Previous warnings about the use of AI for the purposes of digital transnational repression are often extrapolated from the technology’s capabilities, rather than concrete examples. Anthropic’s report gives unusually detailed insights into how state actors benefit from frontier models to scale up their repressive repertoire, both domestically and transnationally. The report demonstrates how AI models can be used to supercharge digital transnational repression—further facilitating the spread of authoritarian and repressive policies outside the borders of the perpetrating states.
Capabilities Identified in the Report
First, Anthropic’s report demonstrates how AI lowers operational costs, making repression more accessible. Operations of digital repression have usually depended on language skills, trained intelligence analysts, and software engineers. The cases in the report suggest that AI can substitute for parts of this expertise. In the campaign against Uyghurs in Syria, operators used Claude to profile targets according to their vulnerabilities and craft a recruitment script in Syrian dialect, despite not speaking Arabic themselves. In the case of three state-backed Iranian influence operations, the actors relied on the model to develop complex campaign plans, operation manuals, and persona systems, working in several languages to promote regime narratives and target, among others, the persecuted Baha’i religious minority and Iranian opposition figures at home and abroad.
Second, AI models are being used to convert digital traces into detailed information that can be used to track specific targets. Diaspora communities generate large amounts of publicly accessible data across social media, messaging platforms, public databases, and organizational websites. AI assistants can take this fragmented data and structure it into detailed intelligence reports. These reports can reconstruct social networks and relations, infer political affiliations, pinpoint locations, and even flag vulnerabilities.
In one case, a commercial intelligence vendor likely working for Arabic-speaking customers in the Gulf region created a platform to analyze the social media activity of diaspora users, mapping their location and categorizing them as pro-government or opposition. Anthropic disrupted this operation before it was deployed.
Third, Claude is being integrated into standardized workflows that repeatedly collect information about targets across borders. Repressive operators rely on models to build entire surveillance systems and supporting infrastructure, allowing small teams of human operators to oversee recurring, partly automated surveillance reports. In one instance, a Chinese security contractor used Claude to produce daily “public opinion” briefings for government officials that “catalogued dissidents, activists, ethnic minority and Chinese diaspora communities, and foreign media as threats to political stability.” The operator also created a system that enabled the automated review of 15-30 or more foreign media articles per day. The resulting briefings included recommendations for government enforcement action, turning the monitoring of overseas communities into a routine bureaucratic process.
Finally, the report substantiates that AI-enabled surveillance can lead to real-world acts of transnational repression. The technology produces information that can support physical surveillance, coercion, informant recruitment, the deployment of agents, and the disruption of civil society activities. For instance, in the campaign targeting Uyghurs in Syria, the operators used Claude to identify targets’ physical locations and family members that could be used as leverage. Other operations used AI to conduct reconnaissance of the physical spaces where diaspora communities organize. In one China-affiliated operation against religious minorities, Claude helped compile actionable surveillance files, including “floor plans, facades, and structural diagrams” of religious venues. In another, a China-affiliated actor researched a protest route in Vancouver, Uyghur events in Turkey, and the Oslo Freedom Forum. Although the report does not establish that this reconnaissance led to physical attacks, the cases show how AI-assisted analysis can support authorities to monitor, intimidate, and threaten activists beyond their borders.
Anthropic’s report only reflects one company’s visibility and detection practices over a short period. Further, some of its attributions are expressed with limited confidence (for instance, Anthropic could not always conclusively determine whether an action had been taken by a state-linked contractor). However, the report’s significance lies in the operational detail it provides. The cases show that malicious capabilities previously discussed as prospective, or documented through isolated examples, are already being more widely incorporated into practices of cross-border surveillance and coercion. Taken together, these observations point to an alarming change in the pace and scale of digital transnational repression. This raises urgent questions about the responsibilities of the companies whose models facilitate it.
Looking Ahead: Three Recommendations for AI firms
The use of AI models to facilitate digital transnational repression demonstrates how technology produced by companies like Anthropic can have an adverse impact on human rights. At minimum, digital transnational repression involves breaches of the rights to privacy, freedom of expression, and peaceful assembly. AI models facilitate and enhance such rights violations by making it easier for states to develop tools that engage in different types of surveillance, from social media content to the installation of mercenary spyware. The United Nations Guiding Principles on Business and Human Rights (UNGPs) requires businesses to address adverse human rights impacts with which they are involved. As part of their obligation to mitigate these harms, AI companies need to work on three areas: (1) incident disclosure and information sharing; (2) detection and refusals; and (3) digital evidence preservation.
AI Labs should develop standard systems for threat disclosure and community notification: Anthropic’s September report is laudable because it is detailed and provides specific information regarding potential and ongoing threats facilitated by Claude. Other frontier companies—OpenAI, DeepMind and xAI, for example—may be seeing comparable activity, but the absence of standardized reporting makes that difficult to assess. Ensuring that threats are publicly reported in a routine and timely manner would assist targeted communities in responding to the threats against them.
Companies should partner with researchers and civil society to consider what a responsible threat notification protocol could look like. Many technology companies—including Google and Apple—have built processes for informing customers who are targeted by state-backed operations. AI companies will face different constraints as the targeted communities are not necessarily customers. However, there are steps they can take. AI companies already notify companies who have been hacked by their AI agents, so some form of reasonable community-level notification—in a format and language accessible to the targeted community—is a reasonable proposition.
AI Labs should improve digital transnational repression (DTR)-specific safety measures for threat detection and refusals: Partnering with DTR researchers to improve DTR-specific prompt detection and refusals would ensure this threat remains constrained as AI capabilities advance. The report demonstrates that on many occasions, Anthropic was able to detect and stop operations before they were widely deployed. However, in some cases, the threat actors were able to circumvent the refusals by re-prompting the model. This happened in one of the Chinese domestic surveillance cases detailed in the report where a police academy student’s requests for surveillance reports were initially refused but then granted when the student re-prompted the model, identifying 10 individuals for police targeting. Rather than focusing on easily detected overtly repressive language, such detection systems should flag combinations of capabilities (social media monitoring, geolocation, vulnerability profiling, and political inference) that together indicate a DTR workflow.
The threat report also delivers a clear demonstration that AI-surveillance is not limited to advanced search functions that carry out surveillance, but also as engineering support for building independent surveillance products. For example, the report discloses an Iranian actor who built a Firefox extension—designed for social media harvesting and analysis—using Claude coding support. Even more alarmingly, in a domestic surveillance operation in Mali, a single security contractor was able to use Claude’s engineering and design capabilities to build a mass surveillance product, “Lakana 360,” to monitor approximately 25 million SIM cards. The resulting system runs entirely on local models, so while Anthropic banned the user’s account, it had no ability to disable the deployed product itself. Detecting these products early is the most realistic way of ensuring they never become operational.
Incident detection should include a plan for evidence preservation: There is a growing body of cases—both civil litigation and criminal investigations—resulting from cases where DTR translated into physical harm to affected individuals. This pattern suggests that Anthropic and other frontier labs should be carefully preserving detailed incident reports, including attribution data, that could support future investigations. While the exact contours of what should be preserved depends on local law and is contested, this is likely something the companies have contemplated for other circumstances, and so, any such frameworks should be explicitly extended to DTR cases.
These three recommendations provide a baseline for the measures companies should consider to reasonably respond to AI-enabled digital transnational repression. Absent sufficient safeguards, governments and their proxies will increasingly exploit AI assistants to supercharge surveillance across borders. To meet this challenge, digital threat researchers and frontier labs need to collaborate on early warning systems that keep pace with emerging tools and tactics. Finally, when harm is detected, companies should notify affected communities and preserve evidence for potential accountability efforts.
