This is the week the safety argument stopped being about a far-off apocalypse and became about the thing already in your feed. Jacob Klein, Anthropic’s head of threat intelligence, published a 154-page report Thursday cataloguing what people actually did with Claude over the past eight months — and it reads like the first draft of the worst-case scenario his own colleagues spent the week warning about. Scientists tied to foreign governments used it to research how to make a virus more lethal. Russian state media used it to fabricate a foreign election. Iranian and Chinese state actors used it to sort through mountains of social-media posts and pick out dissidents. And for eleven straight months, the filter that was supposed to catch the worst of it was switched off.
Nobody had to imagine any of this. The machine didn’t have to turn evil to do evil. It just had to be competent, and pointed at the right people. That is the real story underneath the report: the tools are already dangerous in the hands of the wrong humans, and the wrong humans figured that out long before the rest of us stopped arguing about whether the danger was real.
Jacob Klein — The Man Who Reads the Machine’s Worst Mail Just Handed It Over
Klein’s job is to find the people misusing Claude and shut them down, and his report — released a day after one Anthropic researcher resigned and another put the odds of human extinction at better than one in ten — reads like a man deciding the public deserves to see what he sees. Politico reports the company moved to disrupt every case in the file and handed the evidence to governments and industry groups. The range is what’s startling: fake dating apps built to defraud users, surveillance systems built to identify and monitor dissidents, state propaganda outfits, commercial spyware vendors, and scientists trying to engineer a deadlier chikungunya virus.
Klein did not dress it up. “You are not seeing someone in a comic book kind of way say, ‘Hey, I want to build a biological weapon to kill everybody,'” he said. “It’s an incredibly nuanced situation.” Translation: the nightmare doesn’t announce itself. It arrives wearing a lab coat and a research grant.
The people closest to the machine spent the week telling us it could kill us all. Thursday, they showed us it’s already being aimed.
The Dissidents — AI Didn’t Need to Hunt Them, It Just Needed to Sort Them
The most disturbing line in the file concerns people whose names we will never know. Anthropic’s own account says Iranian and Chinese state actors used Claude to analyze reams of domestic social-media content to pinpoint potential dissidents and surface politically sensitive content. This is what surveillance becomes when you hand a state a machine that never sleeps and never tires of reading: the hard part was never finding people. It was reading all the posts. The machine reads all the posts.
Think about what that means for one real person. You are a student who said the wrong thing about the government three years ago on a small platform. You forgot about it. The model didn’t. It doesn’t forget, it doesn’t flag, it doesn’t get bored — it just sorts you into a list, and hands the list to someone who will act on it. You don’t get a warning. You get a knock on the door.
Surveillance has always been limited by how many humans you could hire to read. The model removed the limit. That is the whole ballgame.
The Bio-Filter Gap — Eleven Months Where the Guardrail Was a Suggestion
Then there is the detail that should keep a safety advocate up at night. GV Wire and the report both confirm that Anthropic’s bio-risk filters were disabled on contractor traffic from May 2025 to April 2026 — eleven months, roughly 133 million exchanges across about 50,000 contractors. A retrospective review flagged 1,197 high-risk transcripts. Anthropic found no confirmed evidence of an actual bioweapon emerging from the gap. That is meant to be reassuring.
It is not reassuring. The gap means that for nearly a year, the model’s most dangerous potential use case ran without the one safety net designed for it, and the only reason anyone noticed is that someone eventually looked. The filter didn’t fail. It was off. There is a difference, and it is the difference between a system that works and a system that works only when someone remembers to turn it on.
The containment systems worked right up until the moment nobody was watching them.
Moldova — An Election Where the Lie Wore a Newsroom’s Clothes
Russian state media used Claude to generate propaganda dressed up as independent reporting, including fabricated claims about an election in Moldova. The Canadian Press adds that the report also found groups that created hundreds of fake social-media accounts that looked like ordinary people, then used them to amplify a single political line for a week — nine such operations across Russia, Iran, Turkey, and the Persian Gulf.
The voter in Moldova who saw a “news” story about the election did not see a bot. They saw a byline. They saw a layout. They saw the little cues we all use to decide what to trust, and every one of them had been manufactured. The lie did not have to be clever. It only had to look familiar.
The genie didn’t just escape the bottle. It learned how to write the label.
The through-line of all of it is the same: the people who build these systems keep insisting the danger is hypothetical, somewhere down the road, past a threshold no one has crossed. Thursday’s report is the proof that the road is already behind us. The machine is being used to hunt dissidents, to poison elections, to design weapons, and to research viruses — today, by named governments, using the product Anthropic ships. The safety debate should be over. The only open question is who pays the bill, and the answer, as always, is the people who never got a say.
Sources: Politico, Anthropic, GV Wire, The Canadian Press.